Documentation forSecurity Event Manager

Determine which logs to monitor with SEM

Before you begin monitoring logs with SEM, SolarWinds recommends that you decide which logs to monitor. Avoid an everything, all at once approach, as it is easy to become overwhelmed when all log data is sent to SEM. To determine which logs to monitor, do the following.

  1. Identify your goals by listing what you want to accomplish with your log data. Consider the business drivers that require you to monitor logs.

    If you have a compliance-related goal, you could focus on your data center and monitor security events. If your goal is to monitor logs for outages, you could verify that your servers are sending logs, and that you are receiving events from Microsoft Windows event logs.

  2. Identify the systems that have the log data you want to monitor. If your goal is to monitor logs so you are PCI-compliant, identify the systems and network devices that are in scope for compliance.

    For each identified system and network device, identify which specific logs are in scope, and the level of logging, if applicable.

  3. Begin with what you know. This can help you avoid learning about SEM and your logs at the same time.

    Monitor the logs that are familiar, and then scale from there. For example, if you are most familiar with your Windows security, application, and system event logs, begin monitoring those logs first. SEM also provides connectors to read many other different types of logs.

Use the following table to identify the logs to collect:

If You Need To Track... Collect These Kinds Of Logs
Changes

User/Groups: Windows security logs

Systems: Windows system and application logs

Application-specific logs

Network devices (firewalls, routers, switches, etc): syslogs

Authentication failures and successes

Windows security logs

Application-specific logs

Authentication logs on other platforms

Internal and external unexpected network activity

Proxy server logs

Network device logs (syslog)

Service and system activity

Windows systems logs

Application logs

Compliance

Core operating system logs

Application logs