EventLog Analyzer

-

IT Compliance & Event Log Management Software for SIEM

EventLog Analyzer System Requirements

This section lists the minimum system requirements for installing and working with EventLog Analyzer.

Hardware Requirements

For 32 Bit Installation

The minimum hardware requirements for installing and working with EventLog Analyzer are given below.

  • 1 GHz, 32-bit (x86) Pentium Dual Core processor or equivalent
  • 2 GB RAM*
  • 5 GB Hard disk space for the product

For 64 Bit Installation

The minimum hardware requirements for EventLog Analyzer to start running are listed below.

  • 2.80 GHz, 64-bit (x64) Xeon LV processor or equivalent
  • 2 GB RAM*
  • 5 GB Hard disk space for the product

EventLog Analyzer is optimized for 1024x768 monitor resolution and above.

* The following table recommends the disk space and RAM size requirements of the system where EventLog Analyzer is installed. The disk space and RAM size requirements depends on the number of host sending log information to EventLog Analyzer, the number of host log records received per second or the host log data received per day by EventLog Analyzer. The calculation is worked out for 100 hosts and an average log record size of 350 bytes.

Log Records Rate or Volume RAM Size Hard Disk Space Requirement
Per Month to Archive Logs
100/sec or 4 GB/day 2 GB 85 GB
500/sec or 20 GB/day 4 GB 400 GB
1000/sec or 40 GB/day 8 GB 800 GB

MySql Performance Improvement Parameters

For better performance, you can replace the existing MySQL parameters mentioned in startDB.bat/sh, available under <Eventlog Analyzer Home>\bin directory, with the following MySQL parameter changes corresponding to the EventLog Analyzer servers RAM Size.

Hardware RAM Size

MySQL Parameter Changes

2 GB " --innodb_buffer_pool_size=1200M "
3 GB " --innodb_buffer_pool_size=1500M "
4 GB " --innodb_buffer_pool_size=1500M "

Operating System Requirements

EventLog Analyzer can be installed and run on the following operating systems and versions:

  • Windows™ 8, Windows™ 7, Vista, 2000, XP, & NT and Windows™ Server 2000/2003/2008/2008 R2/2012
  • Linux - RedHat 8.0/9.0, Mandrake/Mandriva, SuSE, Fedora, CentOS
  • Ability to run in VMware environment

Supported Platforms & Devices

Universal Log Parsing and Indexing (ULPI)

EventLog Analyzer supports Universal Log Parsing and Indexing technology which allows it to collect, analyze, search, archive and generate reports from any machine-generated logs, even from data sources not listed below, as long as the received log data is in non-encrypted, human-readable format.

Here is a partial list of devices, systems and applications that EventLog Analyzer supports:

System and Device Logs

  • Windows™ 8, Windows™ 7, Vista, 2000, XP, & NT and Windows™ Server 2000/2003/2008/2008 R2/2012
  • Linux - RedHat, Debian
  • UNIX - Solaris, HP-UX, IBM AIX
  • IBM AS/400 - Variants V5R1, V5R2, V5R3, V5R4, V5R5 and V6R1
  • Cisco Switches and Routers
  • VMWare - Syslog of versions
  • Amazon EC2 Instance
  • SNARE for Windows
  • and other syslog supported devices

Application Logs

  • IIS W3C Web Server
  • IIS W3C FTP Server
  • DHCP - Windows and Linux
  • MS SQL Server
  • Apache Web Server
  • Print Server
  • Oracle 10 G Release 2 (10.2.0.3) - Audit Logs

Note:

  • For analyzing logs from Windows NT machine, WMI core should have been installed in the Windows NT machine.
  • Syslogs received from SNARE agents for Windows will be displayed as Windows hosts.

Supported Web Browsers

EventLog Analyzer has been tested to support the following browsers and versions:

  • Internet Explorer 8 and later
  • Firefox 4 and later
  • Chrome 8 and later