I Just thought I'd mention to the list that I posted a write-up on analyzing the effects of the lizamoon SQL injection campaign by looking at logs from httpry_logger through ELSA (both available at http://code.google.com/p/enterprise-log-search-and-archive/) on my blog at ossectools.blogspot.com. httpry_logger can be used stand-alone with whatever log system you're using now. In addition to syslog, it outputs to a number of other formats including basic DBI handle, MongoDB, and flat file. --Martin