For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Five tips for building log management infrastructures
or
Other Security Stories
|
|
|
|
April 14, 2005 (Computerworld) -- Whether you're building your own logging tool or evaluating a log management solution, there are at least five factors you should consider.
1. The retention period
The log retention period obviously depends on your requirements. If you are building out the infrastructure for troubleshooting and short-term reporting, you may need to keep only one or two months of logs. But if you're doing it so your company can be in compliance with the Sarbanes-Oxley Act or HIPAA regulations, you will need to keep at least six to 12 months' worth for the auditors, and possibly more, depending on your corporate retention policy.
As a rule of thumb, if your requirement is regulatory compliance, make the retention period 12 months to be safe. If you can afford it or the product can support it, go even longer.
How long a retention period you select also depends on the volume of logs you receive as well as the tool's ability to manage the log storage. If you're building your own, be sure to take into consideration a log rotation process. For example, if your retention period is 12 months, your process should remove the old logs or put them on tape. If you are evaluating a product, be sure the product has the capability of rotating/purging old logs for you. Don't spend $200,000 and then have to write your own scripts.
2. Log volume
Log volume is probably one of the most critical factors in building your infrastructure. It has a direct impact on your retention policy, report/search performance, aggregation performance and correlation performance.
Vendors often talk about log volumes in many ways but it all comes down to the number of log messages per second you receive. With that number in hand, you can calculate how much storage space you will need. For example, if your log message rate is 2,000 per second (and 3,600 seconds per hour), assuming 200 bytes per message (which is fairly normal), we have:
2,000 x 3,600 x 24 = 172.8 million messages per day
172.8M x 200 bytes = approx. 34GB per day x 30 days = approx. 1,020GB per month
That's quite a bit of data. This exercise brings up a few things you should be aware of.
First, you need a product or need to develop a solution that can handle the message rate that your environment generates. In this example, get something that can handle at least 3,000 messages per second: 2,000 to meet your requirements, and another 50% for growth and for possible spikes. When a virus or a distributed denial-of-service (DOS) attack hits, your traffic or log volume can easily grow more than 50%.
If you are evaluating a product, test it to make sure it doesn't drop any of your logs as a result of performance issues with the software/appliance.
Second, you need something that will compress the log archives.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Long Tail Supplier Collaboration - What's In It For You? 
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Tools circulate that crack Debian, Ubuntu keys
- Former Microsoft manager offers free fix for XP SP3 'endless reboot'
- Can Icahn take on the Yahoo board and win?
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecurityThere's plenty of talk about how to behave during a Customs search of your computer and gear, but Jon Espenschied's got tips for securing your data (and privacy) before you reach the border. Click here to read the latest column by Jon Espenschied |
 |
 |
Layered Security Solutions
Although basic network security issues have changed very little over the past decade, the
network security landscape has changed dramatically. Today's IT professionals still have the
primary responsibility of protecting the confidentiality of corporate information, preventing
unauthorized access, and defending the network against attacks. Security experts and analysts agree that a security solution comprised of multiple layers is the best defense against today's increasingly sophisticated attacks.Download this white paper
|
Universal Threat Management - Because Conventional UTM is Not Enough!
This white paper, written by Mark Bouchard of Missing Link Security Services, examines the challenges confronting today's enterprises with respect to managing threats on a network. It also discusses the need for "Universal Threat Management", which is a security solution approach for all physical locations within an enterprise that require threat protection.Download this white paper |
Selecting the Right Threat Management Solution
This short demo will guide you through key considerations for selecting a solution to manage threats on a network. Learn about the popularity of Unified Threat Management (UTM), and how it fits into an overall security solution. Explore critical elements of a network-wide solution for multisite and large network-size deployments and identify the four key features of a threat management solution.View this demo
|
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
