Kiwi Syslog Server Product Roadmap

We are certainly looking at those general areas of improvement for future releases, but I can't give any specific timeframes.   To help me prioritize, it would be great to have your top use-cases for each category (analyze, correlate, report).  

We have over 270 syslog enabled devices. We are required by NERC (National Energy Regulatory Commission) to monitor our "cyber" assets. We have a very lean resource pool that is unable to designate a person to review and decipher all of the syslogs that are cpatured on a daily basis. It would be great to have the ability to perform analysis and correlation functions on the messages as well as reporting and real-time alerting. This would help us to get a better idea as to what is going on at all time on our system.

The whole analyze/correlate concept is a tall order, made short in people minds by wishful thinking. Basically, what's being asked for is a highly knowledgeable, broadly experience, deeply developed veteran Engineer to work for you--all compressed into a piece of, preferably low-priced software.   That's why the big packages are so costly and so complex.  That's what they are trying to replace.

I find, like IDS, syslog has to be learned. Each device and software revision has pecularities, the most common of which must be understood and worked around.  The message pattern I get from a PIX vs. ASA is different. A sup2 versus 720 can be different.  Nexus is a whole 'nother animal.  Autonomous Cisco APs and WLC controllers are vastly different--despite using the same AP hardware.  You've got to learn what your environment chatters about and weed out the noise so you can listen for the important events.

It's absolutley worthwhile to learn this end of network management--it has helped me to build a strong reputation for the last decade.  I'm the guy who knows there's a problem when nobody else does.  There is nothing more satisfying then have Kiwi email you a message that explains what just went wrong on the 5th floor.

I don't think I need you to tell me what I need to learn or what my "dreams" may be. You do not know our organization and you do not know how we operate. The items I mentioned are the features and functions that my management has requested. We are short staffed and and do not have the resources to look at all of the messages that are received via Syslog. That being said, I was just trying to get some sort of product roadmap for the Kiwi Syslog server. This way, if the roadmap does not fit our requirements, then we evaluate something else, very simple.

I do not need you to tell me what I need to learn or what I don't need to learn. I understand the complexities that go into evaluating a syslog message from different devices.

I am glad that you have built a strong reputation over the last 10 years and you are the "goto" guy. I am not impressed.

Do not respond to any of my future posts. You are of no help to me!!

I'll ask you to do the same and censor your "enlightening" responses to anything I post.

I'm sure most people in your position think a product that sells for under $200 will have "the ability to perform analysis and correlation functions on the messages as well as reporting and real-time alerting" for whatever devices they happen to own.

Best of Luck.

Maybe with your broad-based syslog intelligence, you could develop something that could do the job. Oh, but it has to cost under say....$200?

Or better yet, conduct a worldwide Syslog conference where you can teach every other Network and System Engineers how to decipher syslogs. I bet the registration would cost just under say....$200?

In all seriousness, I apologize for coming off as harsh. That post was right after an 18 hour work day. The cost is not an issue, within reason. Our company does not have a dedicated Network Engineer. The purpose of my original post was just to see where Solarwinds was planning to go with the Kiwi Syslog product line. Greg asked me what I would want so I gave it to him. I do not expect the cost to stay the same when you add those features, that would be insane!

Anyway, I was not planning to get into a "war of words" in the Thwack community. I was just on a fact finding mission. Your post had some good information. I think it was the way in which it was stated that came across wrong.

Have a great day and best of luck to you as well.

Have you taken a look at Splunk? 

You can certainly still use Kiwi too but Splunk can do somewhat of what you might be looking for...worth a look maybe.   As you both have eluded to, you will start adding zeros to the price quickly as you grow.