LogLogic integrates log management with EMC Smarts

LogLogic has integrated its appliance-based log management software with EMC’s Smarts real-time network management technology, the company announced Thursday. Customers using both vendors’ technologies will be able to access 100 percent of the log data from the majority of their devices and software via Smarts.

Log data is the automatic recording of events by computer programs including operating systems, applications, and firewalls, and by devices such as servers and routers.

“It certainly makes sense for LogLogic to team with Smarts,” Jon Oltsik, senior analyst, information security at Enterprise Strategy Group, wrote in an e-mail request for comment. “Security and network operations are merging in many companies so security visibility is essential.”

Log data is becoming an increasingly important resource for companies to access so they can better monitor their systems’ behavior and watch for anomalies. The anomalies could be generated by system malfunctions or by malware such as viruses and worms. For instance, if a server is unusually quiet, it can be a very good indicator that the device is about to crash, according to Dominique Levin, vice president of product management and business development for LogLogic.

Companies can also use the log data automation and reporting capabilities provided by LogLogic to help them comply with best business practices and regulatory legislation including the Sarbanes-Oxley (SOX) rules governing U.S. public companies. While many firms spent 2005 scrambling to comply with regulations like SOX, this year they’re taking a look at how they can better automate and structure their systems to meet stated policies, Levin said in a phone interview Wednesday. System and device alert triggers can indicate when a company is deviating from its stated security and other system policies.

LogLogic 3.0 appliance-based software integrates with EMC’s Smarts Service Assurance Manager, formerly known as Smarts InCharge, according to Levin. EMC acquired System Management Arts (Smarts) for $260 million, closing the purchase in February 2005.

EMC’s Smarts Service Assurance Manager brings together events and analysis from multiple sources and integrates with the Smarts Global Console or Business Dashboard to display the overall health of a user’s network. LogLogic 3.0 forwards system alerts based on the information in the log data to the Smarts software and then integrates with the EMC console to display those alerts, according to Levin. Then, users can right click in Smarts to access the LogLogic archive to examine the raw log data to resolve the cause of the alert, she said.

The tie-up with EMC is a nonexclusive joint sales and marketing agreement, not an OEM (original equipment manufacturer) deal, according to Levin. “It’s a meet in the channel relationship, a door opener,” she said. EMC sales staff have already been trained on LogLogic’s software and appliance.

The arrangement may also result in additional sales of EMC storage systems, according to Levin. “We can store logs on EMC’s NAS and SAN [systems], including EMC Centera, through our NFS interface,” she said. LogLogic estimates that log data can represent up to 25 percent of a company’s enterprise data, generating between 50 terabytes to 100 terabytes of data in a year, Levin added.

There’s no fixed standard for how long to retain log data as yet, but Levin says it ranges between six months for companies using the data to monitor their systems up to seven years for organizations more concerned with compliance issues.

LogLogic doesn’t have a similar relationship to the EMC deal with other network management players. “For a while to come, this will be the only one,” Levin said. “We’ll see how it develops. Both sides have invested a lot in this relationship.” Integrating LogLogic with Smarts took around three months, she added.

There are situations where LogLogic isn’t able to access a particular application’s log data, according to Levin. These situations account for perhaps two percent of the systems in the market, she said. For example, if the mechanism to access the data isn’t present, the application produces very little or no information, or binary text is generated instead of human readable text. In the latter case, LogLogic can carry out custom work so the log data is readable by its software as the company did in the case of Check Point Software Technologies’ firewalls, Levin said.

Founded in 1999, LogLogic has its headquarters in San Jose, California, and has more than 100 customers around the world.