--- title: Log Management and Analysis as a market in its own right date: 2006-03-22T21:51:25Z modified: 2006-03-22T21:51:25Z permalink: "https://redmonk.com/jgovernor/log-management-and-analysis-as-a-market-in-its-own-right/" type: post status: publish excerpt: "" wpid: 553 categories: - Uncategorized timestamp: 2006-03-22T21:51:25Z tags: - Uncategorized --- System logs are one of the great untapped data resources of IT shops. They are analysed, usually in a silo context, often for a machine-specific task such as capacity management, performance analysis or used for post-exceptionaudits. Log files from different systems are not usually brought together and mined, or indexed, for post-hoc reporting, let alone real time analysis. Security customers and vendors are one constituency that has naturally tended to appreciate the value of event logs. But usually this information is considered in quite a narrow context. Its all about correlating security and network data. That is not to say that companies like [Tripwire](http://www.tripwire.com/) or [CyberTrust](http://www.cybertrust.com/) or [QCC ](http://www.qccis.com/) don’t provide a valuable service. But its clearly bounded, and concerns a particular set of risks. Compliance to corporate or regulatory standards on the other hand is a much broader issue, which security incident management is just one element of. Compliance is a business process issue that goes far beyond tracking intrusion detection exceptions and patterns. There are some vendors and technologies emerging that are looking to challenge the idea that log data is cheap, and should be written to background storage in case they are needed later. Log management and analysis is not a subset of security incident management (SIM). In fact SIM is a subset of log management. Log data can be tremendously valuable. I would point to [LogLogic](http://www.loglogic.com/), [LogRhythm](http://www.logrhythm.com/) and Splunk as some organisations to check out. You should check out the [Splunk](http://www.splunk.com/) homepage, if only to see the rather amusing “What’s H0rked in your infrastructure today?” homepage. You can download Splunk and check it out. Get a feel for log analysis. Prism [EventTracker](http://www.eventlogmanager.com/?WT.srch=1&WT.mc_id=GoogleEventLog) and [Network-Intelligence](http://www.network-intelligence.com/solutions/logmanagement/) are another couple of firms in the space. So what’s up with Log analysis? What is your approach? Are you using it in a compliance context? At RedMonk we have decided to track log management and analysis as a sector in its own right, as part of our [compliance oriented architecture](http://www.redmonk.com/wiki/index.php?title=COA_Detail) research. Where does compliance meet log management and analysis? In reporting. Its all about reporting. How do you get IT talking to the business? Provide reports in a language they understand – like Sarbanes-Oxley or [MiFID](http://www.fsa.gov.uk/Pages/About/What/International/EU/fsap/mifid/index.shtml). If you’re going to pay a vendor money for a log analysis solution demand canned reports your business managers will appreciate. Expect them to drive business semantics into the software for you. If you are a vendor of a log management tool, or a customer, please let us know – we would very much like to speak to you. Cote talked to our thinking [here](http://www.redmonk.com/cote/archives/2006/03/a_whole_bunch_o.html). disclaimer: I recently met up with [Andy Lark](http://andylark.blogs.com/andylark/), chief marketing officer of LogLogic, a pal first and a RedMonk client second, and we drank some fine wine at Bedales and talked business. I also know [Andy Grolnick](http://www.logrhythm.com/management.html) , LogRhythm president, and would like to win the company as a client. Stephen O’Grady looked at Splunk, which is open source, and said it is interesting. I have friends at Tripwire and QCC. I had lunch with CyberTrust last week. I think that’s it.