Every network is different, and the regulatory requirements and internal standards with which security professionals and their networks must comply are wide-ranging.

Therefore, the event log management tools that are central to compliance and network administration efforts must be flexible and well supported. Unlike antivirus utilities and other common network tools, event log management software can't be just another software product or a mysterious black box in a server rack. The factors that make every network unique, the very nature of the data being stored, and the structure of the databases on which effective log management strategies rely demand flexibility and scalability. In turn, the tools must be backed by reliable and already tested technical support during implementation and when the inevitable network emergency arises.

Since 1997, Dorian Software has pioneered event log management and today boasts the patented method for total event log management. Themes in the development of Dorian's software titles have consistently been ease-of-use, modularity, flexibility, and scalability. Of these terms, "modularity" is the least common in IT marketing, but it is critical to Dorian's approach to event log management.

An article entitled "Event Response" in the November 2004 issue of Windows IT Pro Magazine nicely describes and applauds Dorian's modular method, but our explanation also takes into account our experiences with customers since 1997:

Our concept of event log management stems from the earlier, more common needs of network administrators to collect log files into a central store, then cut through them later for periodic, casual review or more formal auditing purposes. As security requirements evolved, more networks became interested in monitoring network events at the frontline. Still, as this evolution has taken place, there has never been a single "one size fits all" formula for the handling of log files for every network - some continue to simply monitor or some choose only to collect, for example.

The expansion of regulatory compliance requirements and stricter security standards since 2001 have made our Total Event Log Management Solution a good recommendation for most networks, yet questions remain: For example, what about the management of workstation logs in addition to server logs?

Because the needs of those facing HIPAA or Sarbanes-Oxley differ from others, the need for the inherent flexibility of a software solution remains true. Additionally, the rise in popularity among vendors and sales reps of management consoles, "dashboards," hard-wired appliances, and bloatware are taking solution seekers in the wrong direction.

Ask yourself what you are required to accomplish in event log management. Be wary of "return on investment" claims when you are faced with requirements for your network's security - the primary goal isn't return on investment, it is compliance. No amount of bells and whistles or ROI alone will guarantee your compliance in auditors' eyes. It is for this reason that our modular approach to event log management is best - you determine the log strategy that best meets your needs.

Forced Agent Installation
In some cases, your configuration may require an agent. But, most shouldn't require one. If your network configuration can support agent-free log management, why get stuck with a package that requires agent installation and maintenance? Look for a solution that provides agent-optional capability. Dorian Software provides this.

Proprietary or "Embedded" Databases
These are only a positive for the vendor. Think about it - do you want to be locked into a third party vendor's database structure? Doesn't the flexibility of a mainstream database structure - such as that of SQL - make more sense? Usually a proprietary or "embedded" database is a component of a software company's recurring revenue model - it guarantees that you must keep up with releases and ongoing maintenance fees.

Remember: A standard, mainstream database structure won't hold you or your data captive.

Focus on "Security" Events
Threats come in many forms as any network administrator knows. Unfortunately, many packages rely or have relied on the Microsoft definition of a "security" event - specifically, one that occurs in the Security Log. Because of this, report selection is often limited. Compliance with many of today's regulations and best security practices require a comprehensive view of network health and security, and data of interest isn't found in the Security Log alone. Think about your requirements, your environment, and everything that happens in the Application Log and other log types - many of those should be considered to be under the "security" umbrella as well. For instance, did you know that you can audit printer usage by looking in system event logs?

"Dashboard" and "Console" Packages
Of course, not every console is a bad thing - this is more a question of personal preference in terminology. However, in recent years, these buzzwords are indicators that the package is a "one size fits all" product aimed at marketing to larger enterprises. The upfront cost may seem low, but it is usually a stepping stone to a larger recurring revenue generation scheme - hours in support, thousands of dollars in "add-ons" or "snap-ins," consulting fees and hidden training costs often make these a pit for your budget dollars.

Outsourced Development and/or Support
Contact technical support during the evaluation phase or look at the vendor's "international" locations. Are those locations there to cut cost or better serve the customer? More and more, this issue is becoming one of importance to government agencies, military organizations, and other security conscious organizations. Finally, honestly ask yourself if "lower cost" software or solutions could actually cost you more in downtime, hours spent learning or correcting the software, and training to overcome poorly designed interfaces.

Incompatibility with Syslogs
Many network devices still report critical events using a syslog mechanism. Do you now or can you foresee the need to monitor or audit router, firewall, or UNIX / LINUX (*NIX flavored) machine incidents? Dorian Software provides the capability to work with these types of logs at no additional charge. Whether or not you need it now, at least you have the option.

Hardware and Appliance Based Solutions
This too can be a matter of personal preference. But, think about the inherent flexibility in software - easier update, easier configuration, and independence from the limitations of physical hardware. Do you really want to ship your appliance back to the vendor the night before an audit?

True, more common utilities such as antivirus and search technologies may be well suited to "plug and play" hardware consoles. However, there are many factors on which event log strategy depends that are outside the control of vendors and security professionals:

• database structure and design
• portability of data
• access to data in the event of security breach and the resulting investigation
• network infrastructure and speed
• changes to event log structure and event ID mapping

These factors are likely to drive up both the cost of an appliance and maintenance of that hardware, when the alternative to your network might just be a new server - which helps you avoid a proprietary hardware commitment.