Okay, have security logs, will travel.

I was conducting a lightweight forensic investigation on a new client's LAMP box and didn't feel like using GREP or AWK to, well, GREP through SYSLOG data to follow the timeline of events that led to the aforementioned client machine compromise.

I was looking for an alternative to a heavyweight SEM but didn't want to use something powerful yet lightweight (and sometimes tedious) like GREP or AWK. Well, time to check out Splunk. It seems like a pretty cool log analysis tool even though it's still in beta. Check it out for yourself.

LAMP
GREP
AWK
SYSLOG
SEM

Aren't acronyms wonderful?