Some days, the cost of code is crazy. The ability to build and code solutions to problems is not something everyone has the capability of. But then when you see how little code it can take to solve a problem, you realize just how expensive code can be.
With a bit of messing, I figured out how to write an event messenger in Python to handle a built in system integration. It took me about 300 lines of code.
Funny thing: a few weeks after I figured it out, a vendor offered me their solution. For $15 per month, per site. I kindly told them no. At 20 sites, that's about $1 per month, per line of code. Which is pretty nuts to say the least.
So I moved on, and decided I wanted something a bit more permanent. My code runs as a nohup process on an old Ubuntu box that is acting as a syslog receiver. Which made me think: why can't I write my own syslog receiver?
Nothing really prevented me from doing it, but I didn't have a decent IDE in order to do what I wanted. I've used syslog collectors from SolarWinds and Graylog. Both were functional for what they do, but that don't do what I want them to do. Alerting is part of it. Data collection is another part. But there's so much more that I think should be and could there. Somehow that blend of SIEM and syslog collector always seems to appeal to me. That gathering of "EVEN MORE DATA". And I do understand that more data doesn't necessarily mean better decisions. It just means more data to sort though. And the need for more algorithms that handle that data, so the alerts generated off that data can be reduced from the thousands to individuals.
But like I said, no IDE. Microsoft makes a good one, but it's not free. I like Visual Studio. I just wish they gave it away for free until you get to a certain level. Like the SQL Express model. So I quit using their stuff. And I moved to Eclipse.
Eclipse is pretty decent. The autocomplete makes me mad here and there. But it's functional, and it allows me to build complex, multi-hundred lines of code applications.
Like my syslog collector. That I finally wrote in Java.
And that's about all it does right now is collect syslogs. But I've got plans for that sucker. Because eventually I'm going to take that 300 lines of Python code and turn it into Java. And I'm going to attach a SQLExpress database to it, along with an IIS front end for a web application view of the mess I'm creating in the background. Why? Because I like web front ends.
And because I want to learn more about SQLExpress and IIS. And that's generally a good enough reason for most of these projects. Or at least I think so.