Using Smart-1 600-M Plus as a dedicated log server

[Häggström]

Hi

Maby im overthinking this but consider the following hardware:

Smart-1 600-M Plus Security Management, Log and SmartEvent appliance for 50 gateways (SmartEvent & Compliance 1 year) CPAP-NGSM600M-PLUS

Can this be used as a dedicated Logserver ?  ( not using its included managment and other blades )

Scenario is that we have an existing enviroment with existing managment and gateways where that uses a dedicated software log server in a vmware enviroment and, if possible we would like to decomision the existing logserver and move to the Smart-1 appliance while still keep the existing managment

thanks

/joakim

[PhoneBoy · Accepted solution]

TL;DR: Yes.

We sell the Smart-1 600M Plus as a dedicated Log Server/SmartEvent under the SKU: CPAP-NGSM600M-PLUS-EVNT
The differences between this SKU and CPAP-NGSM600M-PLUS are:

• Network Management is not included in CPAP-NGSM600M-PLUS-EVNT
• SmartEvent is licensed perpetually on the dedicated model (versus paying an annual subscription for it)

Both models can be used as a dedicated log server.

[Häggström]

Thank you very much 

[the_rock · Accepted solution]

I know customer who used it for that purpose. Personally, I would not bother, UNLESS you have lots of logs daily and I mean A LOT : - )

[Häggström]

Thank you, i imagine that they will be very well set up on the log-part with this box going forward then 🙂

[George_Ellis]

---

@the_rock wrote:

I know customer who used it for that purpose. Personally, I would not bother, UNLESS you have lots of logs daily and I mean A LOT : - )

---

LOL.  We have 3 5150s and they are too small.  Moving to 2 6000-XLs.  Generate over 150 GB of logs and index files a day.

[the_rock]

Well, that is A LOT x 100, HAHA. 

[George_Ellis]

I have yet to work for a company that did not have dedicated log servers.  There are usually a pair.  They can be geo located with managed logging to balance network traffic.  As a pair, you will have automatic log forwarding to the other log server if one is unavailable.  With a single, if the log server is down, the gateways save the logs and forward them when the log server is back online.  With a single log server, you may want to pay more attention to the log retention on the gateways setup.