ossec hids sox log analyzer

http://www.ossec.net/en/attacking-loganalysis.html