There's a cathedral in the center of Milan, il Duomo, and it's reported to be the fifth largest in the world. It was started in 1386 and took nearly six centuries to complete. While this is an extreme example of the length and scope of a large building project, it's a good analogy for most log and event correlation system deployments. Colossal, and some might say bloated, it’s a visual cacophony and by the time it was officially finished, renovation had already begun. With many historical structures, the concept of a completion date is false. Nothing great is ever really considered "done." So why is anyone surprised by the length of time it takes to install a log and event system that has so many different types of data to input, so many pieces and parts to coordinate. In order to be relevant and not crumble a few years after you configure it, you need to keep checking and validating the output. Otherwise it ends up as a relic, an artifact of the past, an ancient ruin like the Coliseum or the Parthenon. Organizations don't have the money of an Italian Renaissance prince and can ill afford to pay heaps of cash into something that simply fades away into the dust of time.
↧