up vote 2 down vote favorite
1
share [g+] share [fb]

I am looking at purchasing a SIEM/log management solution. I've read quite a few reviews but was wondering if you all had any personal preference. 2 products that I am especially interested in is Splunk and NitroSecurity's ESM and ELM product. Thanks.

link|improve this question
Product and service recommendations are specifically off topic for ServerFault (see point 4 in the NOT About section of the FAQ) – sysadmin1138♦ Jan 5 at 3:29
feedback

closed as off topic by sysadmin1138♦ Jan 5 at 3:29

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

4 Answers

up vote 1 down vote

Splunk worked well for me. You can try it very easily and there is no license cost for small quantities of logs. The log analysis interface is nice and the product support is excellent. Windows support is improving but I haven't tried the current version to comment more.

I haven't tried the NitroSecurity product.

Do you have a fairly standard environment or specific unusual SIEM needs?

link|improve this answer
Nothing out of the ordinary. Windows and Linux servers and a lot of Cisco gear. – user22492 May 27 '10 at 12:58
feedback
up vote 0 down vote

I've been using EventTracker and it works well for me. i chose it because i didn't have to pay extra for all the modules, everything was included in one license fee, and also as a value-add it comes with change monitoring for windows systems.

link|improve this answer
feedback
up vote 0 down vote

Splunk and Nitro are two completely different solutions to completely different problems. The SIEM space is defined as log management (SIM) and event management (SEM). Nitro does a good job of pulling together SIM and SEM and a few other things in to a low-end bundle for the SMB space. Splunk is really just very good IT search. It lacks most of the functions of a SIM and is not included in the Gartner SIEM magic quadrant.

So the question is what is it you really want to achieve? If you're looking for log management then the undisputed leader is LogLogic in the enterprise space. If you're looking for SEM then there's a few vendors (including LL) that offer viable solutions.

Forrester and Bloor both have good papers on this subject.

And just so you know my bias, I work for LogLogic.

Andy Morris Product Marketing LogLogic

link|improve this answer
feedback
up vote 0 down vote

Also look at the new player in the SIEM area, accelops.net (http://www.accelops.net). It combines the SIEM solution with performance, availability and change management, completely new trend in network monitoring.

See http://www.accelops.net for more info.

link|improve this answer
feedback