I'm not sure how much you want it to scale, but I implemented SELM for a client
recently that had bought a 20-server license and was using it to monitor 14
servers. We implemented it using SQL Server as the backend database as part of
a Sarbanes-Oxley compliance effort.
The client had initially enabled all of the pre-configured rules, so the "main"
database quickly grew in size. This caused problems in the archival feature --
where events in the "main" database older than a specific number of days are
moved to the "backup" database, from which it is eventually deleted. We never
got a clear answer from GFI, but judging from the available debug information,
it looked like there were issues with the amount of data being moved from one
database to the other, the transaction log vs. commit frequency within the GFI
code, and the SQL Server Recovery Model. We resolved the issue by starting
over from scratch (i.e., new databases) and very selectively enabling and
defining the rules.
I recently checked in with the client, and they are happy with its performance
at this point. From an operational perspective, it beats manually reviewing 14
individual security event logs. It is priced at a point that it would be
worthwhile for some companies verus a more expensive solution. Of course, it
ultimately depends on the requirements . . .
Hope this helps.
- Brian
-----Original Message-----
From: Graxius [mailto:graxius@gmail.com]
Sent: Friday, April 22, 2005 4:58 PM
To: focus-ids@securityfocus.com
Subject: GFI SELM Question
Hello All,
I am curious if anyone is using GFI's System Event Long Manager and if
so how well has it scaled?
Thanks!
--------------------------------------------------------------------------
Stop hurting your network!
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based
intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Stop hurting your network!
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------
