RE: GFI SELM Question

["Chris Petersen" <chris.petersen () logrhythm com>]

******** I represent the vendor **************

When looking at log management solutions that write to a RDBMS, ask the
vendor how they are dealing with large database table record counts.  You
can't keep writing millions of records (logs) into a database without
eventually reaching a performance bottleneck.  If there answer is buy bigger
hardware, get worried.

I can't speak to SELM capabilities but if you are looking for something on a
larger scale, we have one customer monitoring 300+ Windows servers (all 3
event logs) on a single Log Manager (HP DL380 ~5K server) using both our
agent and agent-less capabilities without a hitch.  They are centralizing
approx 5 Million logs/day.

Chris Petersen, CTO
(303) 413-8740 (direct)
(720) 938-2589 (mobile)
(303) 413-8791 (fax)
chris.petersen () LogRhythm com
www.LogRhythm.com 

> -----Original Message-----
> From: Brian Browne [mailto:brian.browne () edoxa com] 
> Sent: Monday, April 25, 2005 12:41 PM
> To: graxius () gmail com; focus-ids () securityfocus com
> Subject: RE: GFI SELM Question
>
>
> I'm not sure how much you want it to scale, but I implemented 
> SELM for a client recently that had bought a 20-server 
> license and was using it to monitor 14 servers.  We 
> implemented it using SQL Server as the backend database as 
> part of a Sarbanes-Oxley compliance effort.  
>
> The client had initially enabled all of the pre-configured 
> rules, so the "main" database quickly grew in size.  This 
> caused problems in the archival feature -- where events in 
> the "main" database older than a specific number of days are 
> moved to the "backup" database, from which it is eventually 
> deleted.  We never got a clear answer from GFI, but judging 
> from the available debug information, it looked like there 
> were issues with the amount of data being moved from one 
> database to the other, the transaction log vs. commit 
> frequency within the GFI code, and the SQL Server Recovery 
> Model.  We resolved the issue by starting over from scratch 
> (i.e., new databases) and very selectively enabling and 
> defining the rules.
>
> I recently checked in with the client, and they are happy 
> with its performance at this point.  From an operational 
> perspective, it beats manually reviewing 14 individual 
> security event logs.  It is priced at a point that it would 
> be worthwhile for some companies verus a more expensive 
> solution.  Of course, it ultimately depends on the requirements . . . 
>
> Hope this helps.  
>
> - Brian
>
> > -----Original Message-----
> > From: Graxius [mailto:graxius () gmail com]
> > Sent: Friday, April 22, 2005 4:58 PM
> > To: focus-ids () securityfocus com
> > Subject: GFI SELM Question
> >
> >
> > Hello All,
> > I am curious if anyone is using GFI's System Event Long 
> Manager and if 
> > so how well has it scaled?
> >
> > Thanks!
> ----------------------------------------------------------------------
> > ----
> > Stop hurting your network!
> >  
> > The NeVO passive vulnerability sensor continuously finds 
> > vulnerabilities, applications and new hosts without the 
> need for network scanning.
> > It also finds compromised systems with application-based intrusion 
> > detection.
> > Go to http://www.tenablesecurity.com/products/nevo.shtml to 
> learn more.
> >
> ----------------------------------------------------------------------
> > ----
>
> --------------------------------------------------------------
> ------------
> Stop hurting your network!
>  
> The NeVO passive vulnerability sensor continuously finds 
> vulnerabilities, applications and new hosts without the need 
> for network scanning. 
> It also finds compromised systems with application-based 
> intrusion detection. 
> Go to http://www.tenablesecurity.com/products/nevo.shtml to 
> learn more.
> --------------------------------------------------------------
> ------------


--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------