What do you use to view all of your server event logs in one place? Is it clean?

I currently set up the following:

Windows server running snare

centos55 running rsyslog + mysql + loganalyzer

It's not really as clean as I desire, and I am finding information events from Windows being wrongly marked by snare as warning/critical

I would like something extremely clean, where you can delete events from the web front end.

I really should try and get paid by these guys... http://www.linuxquestions.org/questi...server-859256/

I saw that post and set it up for testing... Have yet to figure out how it collects data from the win servers, should get that figured out today! Thanks!

What NMS do you use?

-----
EDIT:

Okay do you or anyone else have any well written howto on how to set this up? I am finding documents like this one - http://www.splunk.com/base/Documenta...MonitorWMIdata
However the steps they walk you through are missing pieces.

. Click Manager in the upper right-hand corner of Splunk Web.

2. Under System configurations, click Data Inputs.

3. Click WMI collections.


I do not have "WMI collections"


Edit #2:

Just put splunk on a win virtual machine and voilà, looks like monitoring win events is best done from a win splunk instance?

Yes absolutely. It's your collection agent, your forwarder and your central server, depending on how you plumb it in. you might want to look at the 'lightweight forwarder' mode which turns an installation into a low footprint service, not unlike snare, which only collects and forwards data, no during, web ui, searching etc. alternatively, distributed search on the paid version is also ace.

As for my nms, i'm a contractor so not specifically using anything. I'm very interested in seeing how feasible it is tui actually use splunk as the nms itself. If you look at, for example, the unix app on it, there's your nms for nix boxes... cpu loads etc.