« What the heck is Oryza Sativa and what's it got to do with Log Management? | Main | Bilski, the Supreme Court, and Lost »
An event by any other name
By Christophe Briguet
There are two well known acronyms in the SIEM world that are often use without too much distinction: MPS (Message Per Second) and EPS (Event Per Second). These two metrics have almost the same meaning and are both used unthinkingly to describe the amount of data generated by a source, or manageable by a SIEM solution.
I’d like to clarify the terminology as we use it:
- MPS is the rate of incoming data received or managed by a Log Collection solution. Usually a Message is any line of log, that either have either security significance or not.
- EPS is the rate of incoming data received or managed by an Event Correlation solution.
Knowing these two metrics is a critical requirement for the success of a SIEM deployment. We recommend keeping the EPS rate lower than the MPS rate by filtering and only forwarding messages to the Event Correlation layer that will be needed for real-time for alerting and critical event notification.
In LogLogic’s SEM, an Event is a standardized data object (based on both IDMEF and the LogLogic ontology) representation of a log entry that has been normalized by at the collection layer. The Events collected by the SEM Appliance are also called ‘Elementary Events’. When these events are aggregated by the aggregation engine they are called ‘Aggregated Events’.
Posted June 22, 2010 in LogEd | Permalink
August 2010
| Sun | Mon | Tue | Wed | Thu | Fri | Sat |
|---|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| 8 | 9 | 10 | 11 | 12 | 13 | 14 |
| 15 | 16 | 17 | 18 | 19 | 20 | 21 |
| 22 | 23 | 24 | 25 | 26 | 27 | 28 |
| 29 | 30 | 31 |
Categories
Archives
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
- January 2006
- December 2005
- November 2005
- October 2005
- September 2005
Blogroll
Blogroll
Compliance
Good Reading
- Internet and Web Security Review
- Log Management ROI
- Log Management Best Practices
- SANS Institute Log Management White Paper