■ www.balabit.com
■ www.balabit.com
syslog-ng Description
■ IT environments constantly generate
important data in log messages
■ syslog-ng □ Collects □ Filters □ Classifies □ Normalizes □ Stores □ Transfers
■ syslog-ng is not a log analysis tool but it is
■ www.balabit.com
Log Management Infrastructure Debugging
Software InfrastructureDiagnostics Compliance Security
The Evolution of Log Management
Servers, Routers, Gateways Network Configuration Changes Audit Logs File changes Authentication Radius LDAP Firewalls Intrusion Detection Identity Access Management Business Intelligence Web Servers Clickstream Data Custom Applications Databases ERP CRM Mobile Devices ■ More data
■ More complex data ■ More important data
■ Can your log management
■ www.balabit.com
Product Family
■
syslog-ng Open Source Edition
□ Leader since 1998, de facto standard in 2001 □ Large, world-wide community
■
syslog-ng Premium Edition
□ Commercial version □ Additional features □ Professional support
■
syslog-ng Store Box
□ Turnkey appliance
■ www.balabit.com
syslog-ng Open Source Edition
■
Key Features
□ Flexible message filtering and re-writing □ Pattern-based classification
□ Secure log transfer via SSL/TLS
□ Flow-control – adaptive message rate
control
□ High speed processing > 650k/sec
■
Community
□ 100,000s of users worldwide □ Well know by system admins □ Included in 3rd party devices
■ www.balabit.com
syslog-ng Premium Edition
■
Additional Features
□ Zero Message Loss
□ Reliable Log Transfer Protocol
(RLTP)
□ Client side failover □ Disk buffer
□ Encrypted log storage
□ SQL source and destination support □ Windows support
□ Support for more than 50 server
platforms
■ www.balabit.com
syslog-ng Store Box (SSB)
■ Key Features
□ Turnkey solution
□ Web-based Graphical User Interface (GUI)
□ Flexible message filtering, classification, re-writing □ Encrypted storage
□ Fast search capability via indexing □ Message rate alerts
□ Customizable reports
■ www.balabit.com
Key Technology Differentiators
■ Reliability - Zero message loss□ Application level acknowledgement - Reliable Log Transfer Protocol □ Disk-based buffer
□ Client side failover
■ Security
□ Encrypted transfer and storage
■ Scalability
□ High speed processing < 650k/sec
■ Flexibility
□ Widest platform support
□ OS support AIX, FreeBSD, Solaris, RHEL, SLES, Debian, Ubuntu, Tru64
□ CPU architectures - x86_64, i386, Alpha, PA-RISC, Itanium, SPARC, POWER □ Wide variety of logs messages natively supported
■ www.balabit.com
Typical Use Cases
■
Enterprise Class Log Management
□
Distributed, heterogeneous IT environments
■
Optimizing SIEM solutions
□
Lower TCO, Improve analysis performance
■
Compliance
□
Meet SOX, HIPAA, PCI-DSS and more regulatory
requirements more efficiently with reliable,
tamper-proof data
■
Forensics
□
Find out what, when, and who more quickly with
■ www.balabit.com
Typical Use Case
Optimizing SIEM
■ The Challenge – Ensuring data feeding SIEM is reliable
□ “By 2016, 40% of enterprises will actively analyze at least 10 terabytes of data for
information security intelligence, up from less than 3% in 2011.” source: Gartner
□ Analysis is only as good a the data feeding it
□ Many SIEM installations fail due to poor log management
■ The Solution – Optimize SIEM with robust log management
□ syslog-ng improves SIEM installations with □ Wider log source coverage
□ Extensive platform support □ Zero message loss
□ Optimize Performance
□ Faster SIEM query times – analyze what is important
□ Lower TCO – SIEM vendors offer usage or capacity based pricing (eps or
■ www.balabit.com
Typical Use Case
Enterprise Class Log Management
■ The Challenge – Managing logs in a large, global IT environment
□ Large distributed IT infrastructure
□ 100s of locations, 1000s of log sources □ Heterogeneous environment
□ Many legacy systems, custom applications □ Mission critical
□ Business processes rely on infrastructure and applications
■ The Solution – Centralize log data
□ One tool for collection and pre-processing
□ Collect from wide variety of sources □ Filter, classify, parse, re-write
□ Wide range of server platforms supported
□ Scale to the largest IT environments
■ www.balabit.com
Typical Use Case
Forensics■ The Challenge – Find out what, when, who...and fast
□ IT Operations
□ Server or network crash □ Fraud investigation
□ Internal or external threats □ Legal challenges
□ Providing evidence in court
■ The Solution – Reliable, accessible log data
□ Centralize – Collect log data from a wide variety of sources and locations
□ Organize - Filter, classify, and organize various types of logs to ensure logs are
quickly accessed
□ Preserve – Ensure log data is not lost □ Reliable transfer
■ www.balabit.com
Typical Use Case
Compliance
■ The Challenge – Comply with many regulations efficiently
□ Data Protection - PCI-DSS, HIPAA, EU Data Directive □ Financial - SOX (EuroSox, Jsox), FISMA Basel II
□ Internal Policies - Data retention/deletion
■ The Solution – Reliable log management solution
□ Ensure reliability
□ Zero message loss □ Ensure security
□ Encrypted transport – TLS/SSL □ Encrypted storage – Logstore
■ www.balabit.com
Licensing
■ syslog-ng Open Source
□ Combination of GPL and LGPL
■ syslog-ng Premium Edition
□ Log Source Hosts (25 – 3,000, > 3,000 unlimited)
□ High Speed deployments ( > 200k messages per second) priced individually
■ syslog-ng Store Box
□ Log Source Hosts (50 – 1,000, > 1,000 unlimited) □ Hardware Configurations
■ www.balabit.com
BalaBit Professional Support
■ Post-Sales Support□ “Part of the Product” □ Three level support
□ Level 1 – Customer care □ Level 2 – System Engineers □ Level 3 – Software Developers □ Highly qualified engineers
□ Direct contact with software development team □ Tight coordination with 1st line Partner Support
■ Three Support Packages
□ Base – 8x5, Next business day response time □ Extended – 12x5, 4 hour response time
■ www.balabit.com
BalaBit Professional Support
■ Pre-Sales Support
□ Technical Consultation
□ Project Scoping
□ Proof of Concept
□ Request for Information/Proposal
□ Feature request management
■ Integration Services
□ Design, Planning, Installation □ Pilot configuration support □ Configuration validation
■ Training Services
■ www.balabit.com
■ www.balabit.com
Conclusion
■
Log data is essential for IT operations, security,
compliance, and increasingly for business intelligence
■
Choose a trusted log management infrastructure that
□ Prevents message loss during transfer
□ Prevents tampering with encrypted transfer and storage □ Scales to the ever increasing amount of data
■
To learn more
□ Visit our website
http://www.balabit.com/network-security/syslog-ng
□ Contact our Sales Team – [email protected] □ Contact our Pre-Sales Support Team –
