LogLogic Reviews

You can collect almost any type of log from almost any platform or source. Documentation is extensive with excellent cookbooks. Implementation is very simple and fast. GUI is very intuitive. Platform is stable (max uptime is almost 2Y).

Response to problems was significantly faster. We quickly discovered the cause of the problem and also we have wasted less time on periodic reporting for auditors.

Definitely SIEM – other vendors have gone a lot further in developing SIEM functionality and made a lot more in this area.

MX3020, SEM 1060 and EVA appliance

No. Deployment was fast & simple. In one word - straightforward.

I believe that the uptime of almost two years is a sufficient indication of how stable this platform is (it would be even longer if we had not reboot the device due to the installation of new versions of the OS).

Scalability is more than sufficient – HA clustering, replication, management platform, wide range of device models.

Personally I have not had much to do with them but I was pleased with them.

Technical support for LogLogic in Europe is great. These people have extensive and diverse knowledge, and they are quick to answer with precise technical explanations.

No, but I have tested other solutions from other vendors and there is always something missing (Symantec, Splunk).

It was surprisingly straightforward. After setting up network and initial parameters, the only thing what remain is to redirect logs from source to appliance. All supported log types are automatically recognized and that was great! All together that’s about two hours of work.

Implementation was done in-house. In some more complex situations (integration with OS400) I contacted LogLogic support.

Original setup cost is few days. Day to day cost of using this product is approximately less then one day per month to check reports, apply changes and prepare reports for the auditors. Also some of those reports are automated so the relevant employers receive reports on their emails.

Yes, I have evaluated also Splunk, Symantec, and Q1.

If you are searching for log management solution, LogLogic is probably the best choice. The SIEM functionality is not at that level, and I suggest instead to choose another SIEM solution (eg: IBM Q1). In my experience, a good practice is to separate log management from SIEM in a way that they are two separate systems.

It collects logs, most of the time.

Having logs in a central location helps with troubleshooting, forensic investigations, and legal investigations. Situational awareness is a must for a healthy IT environment.

The biggest issue, cost-wise, is that it seems to deliberately use the lousiest compression it can use and still say it's compressing data. It wouldn't be hard for them to pack 2-3x as much data into an appliance, but then that would mean they couldn't sell as many appliances. But there are lots of areas for improvement, which you'll see in the answers to other questions.

About a year.

Yes, their log collectors work well in homogenous environments, but in the real world where people have a mix of server operating systems, you'll have issues. If you have a mix of Windows 2003, 2008, and 2012 servers, you'll have to use the same OS on the server doing the collecting.

Yes. The piece that collects Windows logs tends to be very unstable once you get it running, which isn't always easy. Be prepared to have to try several versions of the Universal Collector and Lasso Enterprise to find which one works best in your environment. The latest isn't necessarily the greatest. New versions tend to be slow to appear even when there are known issues with them.

Yes. The product isn't designed to allow you to add disk space to it. NAS options are limited to NFS. One of their devices allows you to connect it to a SAN, but check compatibility first as you can run into issues. SAN space, of course, is very expensive.

On a scale of 1-5, 0. They say the right things but don't deliver when it counts. I've given numerous suggestions for improving the product but they've dismissed every single one.

On a scale of 1-5, 0. Lower-level support is only interested in closing tickets as quickly as possible, not in fixing the issue. If you can get a senior-level engineer they're polite and patient but limited by the rest of the organization. Many of their fixes look like the kind of thing I set up at 2am to get through an issue to buy some time until we can fix it right during normal business hours. The difference is they never come back and fix it right.

Yes, we used ArcSight. It was expensive and difficult to configure. That said, none of these products are out-of-the-box solutions, so I caution against any vendor who claims to have one.

You'll need an experienced sysadmin with knowledge of your network and the operating systems you're collecting from, but for a person like that, the initial setup is pretty easy. I was able to get a new appliance on the network and collecting the easiest logs in about a day, which is reasonable.

In-house, with help from the vendor. The help from the vendor wasn't very helpful.

I'm uncomfortable with the idea of ROI on something like this because centralized logging isn't a luxury, it's a necessity. A large company has to do something like this or go out of business.

I wasn't involved in discussions about the initial cost. Ongoing, count on needing one FTE to dedicate to it. At least initially, it will need to be an experienced specialist. Prior Loglogic experience isn't necessary but good knowledge of Windows and Unix is.

Yes, but I wasn't involved in the evaluation. I came in after the fact.

There is a perception throughout the industry that this is an easy product to implement. The more heterogeneous your environment is and the better you know it going in, the easier it will be.