Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at purchasing a SIEM/log management solution. I've read quite a few reviews but was wondering if you all had any personal preference. 2 products that I am especially interested in is Splunk and NitroSecurity's ESM and ELM product. Thanks.

share|improve this question

closed as off topic by sysadmin1138 Jan 5 '12 at 3:29

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Product and service recommendations are specifically off topic for ServerFault (see point 4 in the NOT About section of the FAQ) – sysadmin1138 Jan 5 '12 at 3:29

Splunk worked well for me. You can try it very easily and there is no license cost for small quantities of logs. The log analysis interface is nice and the product support is excellent. Windows support is improving but I haven't tried the current version to comment more.

I haven't tried the NitroSecurity product.

Do you have a fairly standard environment or specific unusual SIEM needs?

share|improve this answer
Nothing out of the ordinary. Windows and Linux servers and a lot of Cisco gear. – user22492 May 27 '10 at 12:58

Splunk and Nitro are two completely different solutions to completely different problems. The SIEM space is defined as log management (SIM) and event management (SEM). Nitro does a good job of pulling together SIM and SEM and a few other things in to a low-end bundle for the SMB space. Splunk is really just very good IT search. It lacks most of the functions of a SIM and is not included in the Gartner SIEM magic quadrant.

So the question is what is it you really want to achieve? If you're looking for log management then the undisputed leader is LogLogic in the enterprise space. If you're looking for SEM then there's a few vendors (including LL) that offer viable solutions.

Forrester and Bloor both have good papers on this subject.

And just so you know my bias, I work for LogLogic.

Andy Morris Product Marketing LogLogic

share|improve this answer

I've been using EventTracker and it works well for me. i chose it because i didn't have to pay extra for all the modules, everything was included in one license fee, and also as a value-add it comes with change monitoring for windows systems.

share|improve this answer

Also look at the new player in the SIEM area, ( It combines the SIEM solution with performance, availability and change management, completely new trend in network monitoring.

See for more info.

share|improve this answer