Event-Log Manager Buyer's Guide

If a network has 7 servers, and every server has 7 event logs that all run 24 × 7, and there are 7 entries per hour, how many event log entries would you have in 7 days? A number that would make any administrator cringe: 8,232 log entries every day and 57,624 log entries per week. Windows event-log data is helpful for monitoring system performance, confirming regulatory compliance, and other tasks, but reviewing the mountains of data these logs produce can be frustrating and time consuming.

Fortunately, event-log management products—also known as event-log managers—can quickly turn that mountain of data into a goldmine of useful information with little administrative effort. While you follow your daily routine, event-log managers automatically monitor your Windows logs and alert you to system problems. They can automatically filter and consolidate data so you can troubleshoot performance problems and identify possible security risks. They can even automatically produce reports to help you identify trends and document regulatory compliance. Use the introductory questions to determine the features you need, then go online and review the product chart to find the right solution for your environment.

Features Abound

There are many event-log managers available, each with different capabilities. To narrow your search, you can start by answering the following questions to determine your most important needs, and the features that meet those needs.

Do you want to use agents? In agent-based setups, you install an agent on all computers you will monitor. Agentless products use at least one server or workstation to monitor the network servers and workstation event logs.

What do you need to monitor? Most event-log managers monitor the Windows Application, Security, System, Directory Service, DNS Server, and File Replication Service logs. Some event-log managers also monitor application logs, such as Microsoft application logs (e.g., ISA Server, SQL Server), and third-party applications logs (e.g., Linux antivirus software).

Do you want to filter and consolidate events? Event filtering sorts and singles out events based on their content. Filtering is necessary if you want to generate alerts triggered by specific error codes or event-description keywords. Event consolidation eliminates redundant reporting of repeating events.

What do you want to happen when an event occurs? All but one of the event-log managers described in the Buyer’s Guide chart offer some type of automatic alert. The nature of alerts varies from sending an email message to having a scrolling LED on a marquee sign. Some event-log managers let you use an executable (e.g., script, program) to customize alerts. If you want a specific action to occur when an event happens (e.g., shut down a server, stop a service), look for products with the automatic actions feature.

What type of reporting capabilities do you want? Event-log managers featuring automatic report generation can provide you with prebuilt reports, such as logon-failure reports and daily specified event reports. If your company must provide proof of compliance for regulations such as the Gramm-Leach-Bliley Act (GLBA) or the Sarbanes-Oxley (SOX) Act of 2002, check out the products with compliance reporting features. If you need to see event trends over time, event-log managers with historical trending would be advantageous. If you have special reporting requirements, some products let you design custom reports.

A Good Start

Getting a better idea of your needs and the various solutions’ features will get your search for an appropriate event-log manager off to a good start. You can use an event-log management product to set up custom alerts and reports so you can learn of problems sooner and analyze trends for better planning. You’ll find expanded reviews for some of the Buyer’s Guide chart products in the “Related Articles” section of the online version of this article.

See associated table