Log management review: LogLogic MX3020

The LogLogic MX3020 appliance is not as feature-rich as some of the competition, but covers the essentials with great ease

Columnist, InfoWorld |

I found the LogLogic MX appliance to be among the easiest-to-use management products, and it has all the functionality most administrators would need for basic log management. The GUI is simple and uncluttered. I didn't find myself looking to help manuals nearly as much as I did in other products.

LogLogic sent its 2U-high MX3020 appliance (version 4.9.1 software), which combines the feature sets of the company's LX and ST boxes, thus encompassing log collection, reporting, archiving, and forensics functions, and adds one or more compliance suites. The test unit came with five Ethernet interfaces and 2TB of RAID10 storage, and it was easily the quietest and coolest -- as in low temperature -- appliance tested. Setup was a breeze.

LogLogic's management interface is accessed via HTTPS and opens by default to a summary statistics dashboard. All the statistics you'd expect are shown, including message rates, CPU utilization, and disk space. The GUI was clean, easy to understand, and responsive. The only missing element is the ability to quickly drill down into more detail via context-sensitive graphs, which many of the competitors have.

LogLogic MX: Event log support and searching Monitored clients can be added manually, one at a time, or through the use of queries, or by allowing the MX3020 to inspect inbound message streams to see if it can identify the source devices. Similar devices or clients can be collected together into a device group for easier management. LogLogic has more than 70 predefined device types (definitions ease message parsing), including most of the popular vendors and generic Syslog.

Monitored clients can be added manually, one at a time, or through the use of queries, or by allowing the MX3020 to inspect inbound message streams to see if it can identify the source devices. Similar devices or clients can be collected together into a device group for easier management. LogLogic has more than 70 predefined device types (definitions ease message parsing), including most of the popular vendors and generic Syslog.