OSSEC vs scanlogd

OSSEC is an open-source host-based intrusion detection system for monitoring systems and network components. It analyzes logs, checks file integrity, monitors the Windows registry, detects rootkits, and can alert users in real time or take active response actions. Monitoring can be agent-based or agentless, and a centralized server applies policies across operating systems, with server-specific overrides. Alerts can use SMTP, SMS, and syslog; active response can block an attack immediately. The system runs on Linux, OpenBSD, FreeBSD, macOS, Solaris, and Windows, and supports self-hosted and cloud environments. OSSEC and OSSEC+ use command-line management; Atomic OSSEC editions add a management console and integrations with cloud services and other tools. OSSEC+ adds machine learning, ELK integration, threat sharing, and additional rules. Free OSSEC is listed at free; OSSEC+ is also free, with registration required. Atomic OSSEC is $5 a month per device. Atomic OSSEC SaaS offers a free 14-day trial for up to 10 endpoints.

scanlogd is a free TCP port scan detection tool for Linux and self-hosted deployments. It captures packets through Linux raw sockets, libnids, or libpcap. The project advises against using libpcap alone when fragmented IP packets matter, recommending libnids for non-Linux systems or monitoring an entire network. The official download page lists release 2.2.8, release files and signatures, an Openwall archive, and source browsing through GitHub. scanlogd is listed in Owl, Debian GNU/Linux, Gentoo Linux, ALT Linux, and OpenWrt, with ports in OpenBSD and FreeBSD collections. A contributed precompiled Win32 build is also linked. The project describes scanlogd as designed to be totally safe to use and points readers to its manual page and a Phrack article. Openwall offers commercial configuration, compilation, and installation support at US $250/hour with a six-hour minimum or US $9,000/week; fixed-price quotes are available for sufficiently specific projects.