Ads by TechWords

See your link here
Receive the latest technology news and information.
Networking
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

QuickStudy: Event Correlation

July 28, 2003 12:00 PM ET

Computerworld - In today's interconnected world, network management is critically important. Those who maintain the network need to quickly pinpoint and fix any problem, whether it's a malfunctioning mail daemon or a damaged fiber-optic link.

Luckily, almost every part of a modern network provides data about what it's doing:

• Operating systems log systems and security events.

• Servers keep records of what they do.

• Applications log errors, warnings and failures.

• Firewalls and virtual private network gateways record traffic deemed suspicious.

• Network routers and switches watch what goes on between network segments.

• Messaging systems forward alerts, such as Simple Network Management Protocol (SNMP) traps, to a central management console.

Besides monitoring their own behavior, all these devices and management programs receive and relay messages from other network systems, leading to duplicate alerts. A single failure or problem can generate a blizzard of event messages.

The more complex the network and the more applications that are distributed, the more event messages, alarms and alerts the appliances will generate. In the end, far more data is generated than anyone can easily scan, and it's all over the place.

In 2000, Chris Jordan, a security manager at Computer Sciences Corp., wrote in a posting to the SecurityFocus Web site, "OC-12 connections can generate about 850 megabytes of event data in an hour." (OC-12 is a fiber-optic connection with bandwidth of 622Mbit/sec.) That translates into more than 600GB of data per month, or 7TB a year -- just for logs and alerts related to a single network link.

"IT managers spend 60% to 90% of their time resolving problems just with simple diagnostics," says Dennis Drogseth, vice president of Enterprise Management Associates Inc., an analyst and market research consultancy in Portsmouth, N.H.

Event correlation simplifies and speeds the monitoring of network events by consolidating alerts and error logs into a short, easy-to-understand package. A network administrator can deal with, say, 25 events based on cross-referencing intrusion alerts against firewall entries and host/asset databases much more efficiently than when he must scan 10,000 mostly normal log entries.

The benefits can be very real: more efficient use of staff time and skills, as well as the prevention of revenue loss resulting from downtime.

According to Marcus Ranum, an independent computer and communications security consultant in Woodbine, Md., "Correlation is something everyone wants, but nobody even knows what it is. It's like liberty or free beer -- everyone thinks it's a great idea and we should all have it, but there's no road map for getting from here to there." Still, a variety of technologies and operations are associated with event correlation:



Jump to comments

specified number of similar events

Additional Resources

EFD vs. HDD - What You Need to Know
WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
Gartner Research Report: Magic Quadrant for Application Delivery Controllers, 2009
WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
Eight Criteria for Server Load Balancing
WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.

What People Are Saying

White Papers & Webcasts

Death to PST Files
Download Now  

Business Process Framework Demo
Learn about Configurable Business Processes and Calculated Fields. Watch Now!

A Green Architectural Strategy That Puts IT in the Black
Levergage green computing across your data center. Read more now.  

Manager Experience Demo
Go beyond self-service solutions to perform more effectively. Watch Now.

Quantifying the Business Value of VMware View
Learn why you should invest in a centralized virtual desktop.  

Asia-Pacific Enterprise Network Solutions
Learn through this Webcast how your business can achieve reliability, performance and value in hard-to-reach locations within the Asia-Pacific region.

Mainsoft Webcast w/ Forrester Research: Drive SharePoint Adoption in Lotus Notes Shops
How can you drive mainstream user adoption of Microsoft SharePoint when your users rely on Lotus Notes?


IT Jobs