argus-clients informal survey

[Desmond Irvine]

Carter Bullard wrote:
 
<snip> 

> I'm pretty much of the opinion that the awareness of Argus
> and its ability to solve real problems for people is where
> the work needs to be done.  Although we've got QoSient,
> Debian, and FreeBSD distributing Argus now, we don't have a
> HUGE following, like I think we could have.  Its hard to
> remember that Argus-2.0 has really only been out for 3 months
> now, but Argus should be getting more attention than it has.

<snip> 

> I believe that I need to be doing what is needed to draw
> more people into Argus, to use it to solve their problems.
> I think that means more applications, rather than to
> continue to tweak the data generation itself.
> 
> Any opinions?

As a somewhat newbie Argus user and lurker on the list I'd like to throw
in my two cents.  I'm using Argus right now, but only to the bare
minimum in that when I have something to investigate I go through my
argus logs and look for specific things using ra.  I'd like to go beyond
this and do a lot more pro-active monitoring, but I'm not sure where to
start.  Most of the documents I've seen on the net about using Argus
refer to older versions of Argus with different client programs
(raservices).  For Argus to become more attractive I personally think
there need to be more "cookbook" examples of how to make use of it. 
Argus gives us an overwhelming amount of data to play with, but there
don't seem to be a lot of real world examples available of what can be
done with it.

Desmond.

-- 
Desmond Irvine                Security Analyst, Information Technology
Sheridan College              Phone: 905-845-9430 x2035
1430 Trafalgar Road           Fax: 905-815-4011
Oakville, ON  L6H 2L1         EMail: desmond.irvine at sheridanc.on.ca