Logblog: A Log By Any Other Name

« The Log Management End Game | Main | SOX Audit Fees Rising... »

A Log By Any Other Name

"Log file" and "LMI" are household terms among IT folks in their struggle to comply with regulatory frameworks like HIPAA, SOX and PCI. But what do these terms really refer to? And how do they relate? Here's a starter:

What is a Log File?

A log file is a file that lists all actions that have occurred on a device, within an application, or on a server. For example, web servers maintain log files that list every request made to the server. Log files provide insight as to where visitors are coming from, how often they visit, and how they navigate through the site. Same for homegrown and commercial applications, firewalls, and Windows servers - to name a few.

Log files provide critical information for enforcing security policies and ensuring authorized access to confidential data, including:

Event origination info
Event time and date
User ID
Type of event
Actions taken
Success or failure
Invalid logical access attempts
Use of identification and authentication mechanisms
Initialization of audit logs
Creation or deletion of system-level objects
Identity of the affected data or component

Many industry regulations and compliance frameworks now recommend keeping an audit trail of this information for six months to a year. Log Data is used when trying to isolate and remediate network issues such as security threats or performance problems, and they are a critical component of compliance audits.

So, What is LMI?

Log management and intelligence (LMI) is the collection, alerting, storage and reporting on 100% of log data from applications, systems and devices. Using "Google-like" indexing and search - and machine learning technologies, LMI solutions enable information to be extracted from terabytes of log data in seconds. Agile reporting allows administrators to report and alert on that log data in real-time. Predefined reports for controls such as COBIT and regulations such as SOX and PCI ease the burden of mitigating risk and implementing compliance. Open Log Services automate the process of routing log data to other management systems such as EMC Smarts.

LMI is needed to manage the vast amounts of log data collected in enterprise networks today. Without it, adhering to compliance frameworks and using log data effectively for enforcing network security policies and is impossible.

Send us your thoughts.

Technorati : Cobit, LMI, Log Management, LogLogic, Logs