Log management has become an essential enterprise service yet to paraphrase Rodney Dangerfield, it gets no respect. Why? Log management is as geeky an IT service as there is as it hums along and collects, processes, and stores cryptic Syslog and Windows Log files. Insert yawn here.
Boring stuff -- yes but increasingly essential. Correlation and analysis of log events helps users detect security events and suspicious behavior. Analysis and reporting on log data is the heart of regulatory compliance. Logs also provide a view into the entire IT infrastructure. Analysis here can help CIOs tune their IT infrastructure and plan for the future.
Let's face it, log management is a foundational technology these days. Users who understand this and build an enterprise-class log management infrastructure will be better prepared for future security, IT, and business challenges.
Log management will eventually evolve into something much bigger. I envision an IT data warehouse in the future that collects log data but also network flows, CMDB records, asset information, vulnerability scans, SNMP events, etc. Users will load this into the IT equivalent of a Teradata warehouse and run all types of queries and reports.
As far as vendors go, I see good things from ArcSight, HP, LogLogic, LogRhythm, and Q1 Labs. Any one of these guys could emerge as the market leader for this future IT data warehouse vision.
The Leader in Network Knowledge
What about Splunk?
Jon, you failed to mention the company with far and away the best technology and fastest growing customer base. Splunk! We just launched our Splunk 4 product which is light years ahead of the "emerging market leaders" you mention. Check out all the buzz on twitter at #splunk. Be happy to give you a demo and chat about our more than 1,100 customers and 350,000 downloads of our software.
Michael Baum
Founder & Chief Corporate Development Officer
Splunk
www.splunk.com/blogs/thebaum
There is a log-analysis mailing list on security focus.
There is a log-analysis mailing list on security focus (securityfocus.com). Check it out for more discussion about logs. Good article.
Ciao,
neil@k2tour.net
what about ManageEngine's
what about ManageEngine's Eventlog Analyzer? The same company as Zoho. They build great stuff too.
It is time to change the way businesses think about logs
I agree with your take, Jon. Log management is a little boring because it doesn't really take an 'action' – however, it is an essential piece of the compliance pie and there is an incredible amount of value for organizations to understand exactly what's happening on their network.
Businesses really do need to change the way that they think about log data. Many organizations are still simply using it for forensic purposes – when it is capable of doing so much more to proactively secure your network from internal and external threats. We also touched on log management on our blog last year: http://blog.trigeo.com/2008/siem-and-log-management/
Michael Maloof, CTO, TriGeo Network Security
Check out HP's fantastic solution !
http://www.accelacomm.com/jaw/link/0/50477974/
Post new comment