The Prelude Log Monitoring Lackey (LML) is the host-based sensor program part of
the Prelude SIEM suite. It can act as a centralized log collector for local or
remote systems, or as a simple log analyzer (such as swatch). It can run as a
network server listening on a syslog port or analyze log files. It supports log
files in the BSD syslog format and is able to analyze any log file by using the
PCRE library. It can apply log file specific analysis through plugins such as
PAX. It can send an alert to the Prelude Manager when a suspicious log entry is
detected.
