LogBlog

« LogLogic named a finalist for the SC Awards 2008 | Main | Poll: Who looks at logs at your organization? »

On Approaches to Database Monitoring

So, people sometimes ask me about how to do database logging/auditing/monitoring and log analysis right. The key choice many seem to struggle with for database auditing and monitoring is reviewing database logs vs sniffing SQL traffic off the wire.  Before proceeding, please look for more background on database log management, auditing and monitoring in my database log management papers (longer, more detailed - shorter)  The table below summarizes the situation with database monitoring and auditing - now you can make your choice more intelligently (items in bold are the ones I consider key):

 

  Pro Con
Sniff SQL traffic from the wire
  • No database performance impact
  • Awareness of returned content (for SELECTs)
  • Guaranteed role separation
  • Better for DBA monitoring
  • No agents
  • No database configuration changes
  • Extra device needs to be purchased, deployed and managed
  • Doesn't work with encryption
  • No local access monitoring
Collect and analyze database logs
  • No extra $$$ - use your existing logging tool
  • Can user review activity across log sources, from databases to servers
  • Satisfies compliance demand for "database log review"
  • Can monitor ALL access to data in the database, even over APIs and local
  • Performance impact possible (*)
  • Database config changes needed
  • Usually not truly "real-time" (polling)

Choose logs if you care for the relevant Pros (esp key ones) associated with them; choose sniffing if you care for the Pros and are NOT undermined by their Cons (e.g. difficulties of supporting encrypted traffic)

Of course, one can also opt for a combined approach which follows the ideas of "double the benefits - for double the cost"...

(*) Nobody really knows what it will be in each particular situation: 0-40% were observed under various conditions by various people ...

Posted December 17, 2007 in Innovation , Log Management & Intelligence , LogMatters | Permalink

TrackBack

TrackBack URL for this entry:
http://www.loglogic.com/mt/mt-tb.cgi/285

Visit loglogic.com

I ♥ Logs

Subscribe to this blog’s feed RSS

December 2007
Sun Mon Tue Wed Thu Fri Sat
            1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31          
Categories
Archives
Blogroll
Blogroll
Compliance
Good Reading
LogLogic
LogLogic Partners
Sites We Watch