Virtual Log Router?

[RSAAdmin]

I'm trying to find information about the Virtual Log Router. Is this a "Professional Services Only" tool?  There is no mention of it at all on the SecurCare site.

Given that much of enVision 4.1 is now virtualize-able, I was wondering if RSA would release the Log Router as a user-installable component.  Based on previous conversations with our SE it seems a lot less involved than a Remote Collector, and might fit a situation we have at a remote site very well.

[RSAAdmin]

I have extensive experience with the VLR at this point. Unless you are doing something quite small I would not recommend it. Its not bad if you just want to collect a bit of data with SNARE. SFTP is a little trickier to setup. It is not really documented for the most part (at least not yet). Note that the VLR is not really envision software. Its a linux image using some standard linux utilities (httpd, rsyslog etc) and glued together with perl scripts. You will have to get a reseller to provide it through professional services, I believe.

[RSAAdmin]

Thanks gc.  We are running a small syslog-ng relay at a remote site currently for things that syslog, but we have a growing volume of non-syslog sources (Windows legacy event log, AS400 via FTP). It would be nice to keep everything coming through one relay in 'real time', but it looks like that might not be possible.

Does the VLR require that all sources feeding it are sending events via syslog?  If that's the case then I guess it doesn't help our situation.

[RSAAdmin]

It does take non-syslog types of transfers. I was able to sucessfully setup the NIC SFTP Agent with it as well. I had very mixed results with Windows WMI. It did not seem stable and would stop reporting. It also supports ODBC but I did not test that. We ended up getting a refund for the VLR and purchased an RC instead.

[RSAAdmin]

Does the Remote Collector allow for near-realtime event collection? I know it has an alerting engine on it, but it appeared from reading the docs that SFTP is the backhaul mechanism, and that only runs every hour or so. That wouldn't fix our current issue, which is an AS400 that generates more logs than we can keep up with transfering across our WAN in batch-mode. We'll be installing a syslog tool on the server and streaming instead.

[RSAAdmin]

It supports both real time and batch transfer. It will send logs via rsyslog to the upstream collector if you chose real time.