While the Phoenix Suns NBA basketball team hits the boards at practice, the Phoenix Suns IT staff hits the server room. The four-person team manages 30 or so servers and infrastructure devices. "To say they're pressed from a staffing perspective is an understatement,” says Mike Reagan, vice president of marketing at LogRhythm. Which, he says, is one reason why the vice president for IT at the Suns chose LogRhythm’s integrated solution of the same name, which incorporates log management, log analysis, event management, and reporting.
“They were missing information that could prevent outages and security breaches. Though they hadn’t had any breaches, they wanted to be proactive.” Log data from server and devices provided information but the Suns didn’t have the staff to mine it.
In looking for a solution, the IT team checked out log management solutions and event management solutions. Ease of deployment and ease of use were most important. “A lot of organizations going to log and event management are short on staff and can't allocate a person to go off and become an expert,” Reagan says. “Bill Bolt \[the Suns VP of IT\] wanted to monitor his Windows server logs and email Exchange logs. We demoed and showed him he could also monitor infrastructure event logs. A Windows server log looks different from a firewall log, but we put all the information into a single format through a log normalization process and correlate and extract the data.”
In the past 18 months, Reagan says, LogRhythm has acquired 70 percent of its customers because of compliance. “Analysts see this growing in importance, too. IT needs tools to get insight to cut problems off at the pass—often drilling into user logs or server logs will give you insight.” Out of the box, LogRhythm can be set up with canned alarms and reports; after log sources are set, you decide the frequency. To meet compliance requirements, the solution lets you generate reports on a regular basis and email them. Data is archived on the Log Manager appliance, which is part of the LogRhythm solution. Metadata is kept online in LogRhythm’s Log Mart tool, which lets IT staff search for trends and anomalies. Most clients use Active Directory logon privileges to access the device, Reagan says, though it lets you define specific users as well. To learn more, visit LogRhythm's website