Thread: Event log monitoring...

Splunk.... I pulled this pricing from a mailing list I'm on so no idea if it is accurate or not:

Prices from back in May...

1gb / 13,393
2gb / 17,858
5gb / 24,554
10gb / 31,250
20gb / 46,875
40gb / 66,965
70gb / 107,143
100gb / 133,929

Annual support is about 20%, in after going back and forth I ended up
paying 14,493 for 2gb/day, about to upgrade to 5gb.

if you're logging 5GB a day... you're going to have the cash to afford it IMO. 5GB of logs per day is one *hell* of a lot of data!

Originally Posted by goscombtech

if you're logging 5GB a day... you're going to have the cash to afford it IMO. 5GB of logs per day is one *hell* of a lot of data!

I'm not so sure tbh Dan... a number of our customers log 5GB+ a day but I wouldn't say they are made of money.

Originally Posted by goscombtech

if you're logging 5GB a day... you're going to have the cash to afford it IMO. 5GB of logs per day is one *hell* of a lot of data!

Its blooming not if you are firewall logging....

I use kiwi syslog for firewall logging and stuff - its free and doesnt have limits on it. It is hard to keep track of so many snmp entries though.

Originally Posted by Pete-CCS

Its blooming not if you are firewall logging....

Yup if you are logging every flow whether allowed or denied then it's easy to go over the 500MB/day free Splunk limit.

Been doing some work with Juniper STRM recently (although it's really just a blue server running Q1 Labs Qradar in appliance form so it depends if you are a Juniper fanboi or not), and it does J/Net/Sflow collection as well. Quite a nice product and actually pretty cheap compared to Splunk. The licensing is in events per second rather than MB/day.

Gavin

Originally Posted by Pete-CCS

Its blooming not if you are firewall logging....

i was thinking more router logs

we syslog everything to a syslog-ng instance which then directs various bits to various logging hosts (splunk being one). This allows us to filter what hits splunk.