Zen 2.0

Another article from my SLA series…

In this installment of a series on understanding service-level agreements, I’ll look at what you need to consider when choosing the hardware used to provide the services.

Service providers offer various hardware options depending on the nature of the security service for which users sign up. Some services will require the installation of dedicated hardware at the customer’s site or, if the service provider will be providing hosting services, in their cage. Some service providers host their own hardware in their own network operations center. Some provide the security service through hardware that is shared with many other customers.

Which option is better for your business depends on many factors, including your security policies, budget, trust in the service provider and the actual products used. In many cases, dedicated hardware may be more expensive than shared hardware.

[Ok, full disclosure, I work for LogLogic, so feel free to junk this if you consider all vendor speak spam ]

A quick bit of news, LogLogic today open sourced (GPL) Project Lasso, a centralized Windows event collector. The original code base came from SNARE but now due to the different nature of the collection mechanism, there’s about 20-25% of the SNARE code left in it. Most of the common code are around message expansion. In fact, the Lasso messages will appear to the users exactly the same as SNARE. So if you already have a parser that can parse SNARE messages, you can parse Lasso messages as well.

Lasso is a LogLogic-sponsored and community-supported collector that can
- perform multi-threaded remote event collection of multiple Windows machines
- reliable transportation using TCP syslog (syslog-NG compatible)
- data buffering when network connection is down
- support for custom application event logs

We are trying to get this on sourceforge, but those guys are a bit slow in setting up new projects. So for now, you can download the binary and source from http://loglogic.com/logforge/.

I would love to hear your thoughts and comments. Don’t feel obligated to love it, you can bash it as well if we did something stupid. We are always looking to make it better.