Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message



Part of a Group Review

ArcSight Logger review

Article comments

Unlike most of the products in this review (all except Splunk), which throw in some SIEM functionality, Logger is strictly for event log collection and reporting. It doesn't include event processing rulesets or make decisions about incoming information and alert you to security events. Rather, it simply sucks in all of the log information you want to analyse and generates reports on it.

For this review, ArcSight sent me the Logger 4 7200-series appliance (2U) with six 1TB RAID5 drives, the maximum amount of internal storage available. Using default compression, ArcSight says the unit can store 42TB of event storage before needing to archive to external storage, though I did not verify this.

Logger 4 runs on 64-bit Oracle Enterprise Linux with one or two Intel Xeon Quad Core 2.0GHz processors, two or four network interfaces, and 12GB or 24GB of RAM. Initial setup was fast and easy, standard for today's appliances. Configuration, management, and operations can be done using a command-line interface or an HTTPS-protected web GUI.

Two of ArcSight's strengths are the number of client platforms it supports and the many ways that event messages can be sent to the Logger. In addition to being forwarded to Logger directly by the hosts using native protocols (UDP, TCP, Syslog, FTP, SCP and so on), event messages can be picked up using a variety of different methods (including text files) or collected and sent using agent software called Connectors. ArcSight provides well over 100 different types of connectors, more than any other vendor. If I could think of it, they had it. If they don't have it, you can probably build it. ArcSight FlexConnectors allow admins to create customised connectors for devices and applications that cannot use existing connectors.

Connectors pick up events in their native format, normalise the data, and deliver the structured data to the ArcSight appliance. Connectors give structure to any unstructured log data, which is important because you cannot run ArcSight reports on unstructured data, though you can run text searches on it. Connectors can also perform event filtering, event message caching, and network bandwidth throttling. The only downside is that ArcSight's connector agents are fairly large (their Windows connector is 179MB) compared to other client-side agents and can take more than 10 minutes to install.

Events can also be collected by one Logger and forwarded to other Loggers and ArcSight solutions, a handy feature for handling remote offices. ArcSight claims that more than 100,000 events per second can be sent to one appliance. I did not stress test this claim, but in my limited tests, Logger handled complex queries against gigabytes of data very well.

Events are collected into individual, customisable storage groups (up to five), which can be set up for particular device types, for different networks, or to meet different collection needs. Storage groups can be configured for size, maximum event age, and reporting priorities. Storage groups are a great feature for managing device resources, and ArcSight's were the most customisable among the products in this review.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *