Log Analysis a top 10 strategic technology for 2010, says Gartner

According to Gartner 2010 should be a good year for vendors in the Log Management market.  Gartner lists “Security – Activity Monitoring” as one of their top ten strategic technologies for 2010.

Gartner’s top ten states, “Information security professionals face the challenge of detecting malicious activity in a constant stream of discrete events that are usually associated with an authorized user and are generated from multiple network, system and application sources. At the same time, security departments are facing increasing demands for ever-greater log analysis and reporting to support audit requirements.”

It’s nice to see that more attention is going toward Log Management and SEIM, finally.  I remember about five years ago, while I was at LogLogic, we had a meeting with a Gartner analyst who told us there was ‘no market for log management’.  I disagreed, and I’m glad we listened to our customers more than the analyst.

Posted in Logging | Tagged , , , , | Leave a comment

Indexing vs. Normalization of logs

Recently a friend asked me whether he should normalize or index logs for faster reporting.  My response was that it depends on who is interpreting the reports.  I suggested he use indexing if the logs are coming from a single application and his users understand the log message format.  However, if the logs come from many different applications or have complicated message formats, then normalization is the quickest and easiest method.  In most cases the best method is to use both indexed and normalized log data if it is an option.
Continue reading

Posted in Logging | Tagged , , , , , | 2 Comments

Quality Log Data is the Foundation of Log Management

LM Hierarchy of Needs - step1

The foundation of the Log Management Hierarchy of Needs is for the applications and devices to produce quality log data. Continue reading

Posted in Logging | Tagged , , , | Leave a comment