QuickStudy: Event Correlation

Computerworld - In today's interconnected world, network management is critically important. Those who maintain the network need to quickly pinpoint and fix any problem, whether it's a malfunctioning mail daemon or a damaged fiber-optic link.

Luckily, almost every part of a modern network provides data about what it's doing:

• Operating systems log systems and security events.

• Servers keep records of what they do.

• Applications log errors, warnings and failures.

• Firewalls and virtual private network gateways record traffic deemed suspicious.

• Network routers and switches watch what goes on between network segments.

• Messaging systems forward alerts, such as Simple Network Management Protocol (SNMP) traps, to a central management console.

Besides monitoring their own behavior, all these devices and management programs receive and relay messages from other network systems, leading to duplicate alerts. A single failure or problem can generate a blizzard of event messages.

In 2000, Chris Jordan, a security manager at Computer Sciences Corp., wrote in a posting to the SecurityFocus Web site, "OC-12 connections can generate about 850 megabytes of event data in an hour." (OC-12 is a fiber-optic connection with bandwidth of 622Mbit/sec.) That translates into more than 600GB of data per month, or 7TB a year -- just for logs and alerts related to a single network link.

"IT managers spend 60% to 90% of their time resolving problems just with simple diagnostics," says Dennis Drogseth, vice president of Enterprise Management Associates Inc., an analyst and market research consultancy in Portsmouth, N.H.

Event correlation simplifies and speeds the monitoring of network events by consolidating alerts and error logs into a short, easy-to-understand package. A network administrator can deal with, say, 25 events based on cross-referencing intrusion alerts against firewall entries and host/asset databases much more efficiently than when he must scan 10,000 mostly normal log entries.

The benefits can be very real: more efficient use of staff time and skills, as well as the prevention of revenue loss resulting from downtime.

According to Marcus Ranum, an independent computer and communications security consultant in Woodbine, Md., "Correlation is something everyone wants, but nobody even knows what it is. It's like liberty or free beer -- everyone thinks it's a great idea and we should all have it, but there's no road map for getting from here to there." Still, a variety of technologies and operations are associated with event correlation: