Massive application systems and network devices are deployed in an enterprise, including hosts, databases, other application systems, switches, and firewalls. Due to inconsistent device log formats, low readability, and difficulties storing massive logs, major security risks cannot be promptly detected from logs. Government agencies and industrial organizations provide guidance and stipulations through internal control laws and standards, which impose higher requirements on the completeness, accuracy, and effectiveness of run logs and user logs.

eSight LogCenter:

• Provides a platform for collecting, storing, and auditing multiple types of large-scale logs in a unified manner.
• Supports log management of Huawei and third-party vendors.
• Provides industry-leading NAT tracing function and security event analysis.

Features

Unified Log Management and Quick Matching Capability

• eSight LogCenter supports multiple log collection modes, including Syslog, session, SFTP, FTP static file, FTP dynamic file, and Windows Management Instrumentation (WMI). Users can collect, classify, filter, summarize, analyze, store, and monitor logs reported from the application systems or NEs to help the administrator manage massive logs and learn NE running status, trace network user behaviors, and quickly recognize and eliminate security risks.
• eSight LogCenter supports prompt notifications of key logs. The administrator can customize keywords, log type, and log level thresholds. When logs match customized keywords, log type, or log level, eSight LogCenter generates alarms in real time and notifies users through SMS messages or emails.

Professional NAT Tracing and Automatic Association with User information to Meet Secure Audit Requirements

eSight LogCenter collects and analyzes logs about sessions on NAT devices to obtain NAT information, including the IP address, destination port, NAT source IP address, and protocols. eSight LogCenter uses the NAT information and the data source provided by the Authentication, Authorization and Accounting (AAA) server to ensure secure audit and traffic investigation.

Profound User Online Behavior Analysis

eSight LogCenter works with Huawei USG and ASG devices to analyze user online behaviors, including user traffic, online time, keywords, web access trends, emails, applications, network threats, and outgoing files.

Rich Security Event Analysis Reports Showing Network Security Status

eSight LogCenter collects security event logs about network security devices and systems, such as Huawei network UTM system, firewalls, intrusion protection system, and Anti-DDoS system, analyzes them, and generates reports to help users learn the network security status. eSight LogCenter supports DDoS attack event analysis, plug-in block analysis, access control event analysis, policy matching analysis, IPS analysis, URL filter analysis, and email filter analysis.

Million-level Log Processing per Second, Meeting Requirements of State-level Network Auditing

eSight LogCenter meets the performance requirements of state-level network auditing and collects and audits millions of system logs in a second, supporting high-performance log collection, storage, and audit functions for large and ultra large networks.

Deployment Scenario

eSight LogCenter network can be deployed in centralized or distributed ways.

Distributed deployment: The Log Collector and the Log Analyzer are deployed separately on two servers.

Log Collector: Receives, summarizes, formats, filters, counts, and stores logs and generates alarms.

Log Analyzer: Manages policies, reports, devices, systems, and users.

Log Console: Provides an interaction GUI for managing foreground and background using the web.

Centralized deployment: When performance requirements are low, eSight LogCenter can also be deployed in a centralized way.

When fewer than 2,000 logs are managed every second in an SMB project, eSight LogCenter and an eSight application base can be deployed on the same server.