Executive Summary:
Event-log management products (aka event-log managers) record and organize event information to alert you about problems, provide regulation-compliance reports, and collect data for system analysis. Use these introductory questions to narrow your search by choosing the features you need. Then head to the Web and evaluate the 22 listed products in our online Buyer's Guide product chart to select the right solution for your environment. |
If a network has 7 servers, and every server has 7 event logs that
all run 24 × 7, and there are 7 entries per hour, how many event
log entries would you have in 7 days? A number that would
make any administrator cringe: 8,232 log entries every day and
57,624 log entries per week. Windows event-log data is helpful
for monitoring system performance, confirming regulatory
compliance, and other tasks, but reviewing the mountains of data these
logs produce can be frustrating and time consuming.
Fortunately, event-log management products—also known as
event-log managers—can quickly turn that mountain of data into a
goldmine of useful information with little administrative effort. While
you follow your daily routine, event-log managers automatically
monitor your Windows logs and alert you to system problems. They
can automatically filter and consolidate data so you can troubleshoot
performance problems and identify possible security risks. They can
even automatically produce reports to help you identify trends and
document regulatory compliance. Use the introductory questions
to determine the features you need, then go online and review the
product chart to find the right solution for your environment.
Features Abound
There are many event-log managers available, each with different
capabilities. To narrow your search, you can start by answering the
following questions to determine your most important needs, and
the features that meet those needs.
Do you want to use agents? In agent-based setups, you install an
agent on all computers you will monitor. Agentless products use at
least one server or workstation to monitor the network servers and
workstation event logs.
What do you need to monitor? Most event-log managers monitor
the Windows Application, Security, System, Directory Service,
DNS Server, and File Replication Service logs. Some event-log managers
also monitor application logs, such as Microsoft application
logs (e.g., ISA Server, SQL Server), and third-party applications logs
(e.g., Linux antivirus software).
Do you want to filter and consolidate events? Event filtering
sorts and singles out events based on their content. Filtering is necessary
if you want to generate alerts triggered by specific error codes
or event-description keywords. Event consolidation eliminates
redundant reporting of repeating events.
What do you want to happen when an event occurs? All but
one of the event-log managers described in the Buyer’s Guide chart
offer some type of automatic alert. The nature of alerts varies from
sending an email message to having a scrolling LED on a marquee
sign. Some event-log managers let you use an executable (e.g.,
script, program) to customize alerts. If you want a specific action
to occur when an event happens (e.g., shut down a server, stop a
service), look for products with the automatic actions feature.
What type of reporting capabilities do you want? Event-log
managers featuring automatic report generation can provide you
with prebuilt reports, such as logon-failure reports and daily specified
event reports. If your company must provide proof of compliance
for regulations such as the Gramm-Leach-Bliley Act (GLBA)
or the Sarbanes-Oxley (SOX) Act of 2002, check out the products
with compliance reporting features. If you need to see event trends
over time, event-log managers with historical trending would be
advantageous. If you have special reporting requirements, some
products let you design custom reports.
A Good Start
Getting a better idea of your needs and the various solutions’ features
will get your search for an appropriate event-log manager off
to a good start. You can use an event-log
management product to set up custom alerts
and reports so you can learn of problems
sooner and analyze trends for better planning.
You’ll find expanded reviews for some
of the Buyer’s Guide chart products in the
“Related Articles” section of the online version
of this article.
See associated table
End of Article
Register
