Q1: For those companies that have successfully implemented enterprise-wide logging, what were the big nasty surprises that they encountered?

A1: Here are a few:

• political boundaries within the organization: "these are our logs, and you are not getting them"
• privacy laws: some logs cannot be collected in some countries; some cannot cross the border, some cannot be seen by some people, etc. This is true mostly in EU, less in US.
• legal blocks: work with legal before deploying any org-wide log management; legal might try to prevent certain data from ever being created (for fear of being legally discovered later)
• log volume: underestimating log volume is common and pretty nasty
• related to the last one: vendors being "optimistic" about their tool scalability
• time synchronization (of course!), specifically, lack thereof.

Q2: For those companies that have successfully implemented enterprise-wide logging, what was their implementation approach?

A2: Typically, 2-3 vendor PoC or pilot first. Then with the chosen vendor: phased approach based on location + type of log source (e.g. firewalls, then routers, then OS, then proxies, etc) + network topology (e.g. DMZ, then internal) + log source criticality (e.g. critical servers first; the rest next). This might be handy to look at.

Q3: What kind of storage requirements have been experienced by those organizations who have successfully implemented enterprise-wide logging?

A3: Massive? :-)

Here is a simple example: PCI DSS is a bit more aggressive than NERC since it mandates 1 year of log retention vs NERC 90 days, so: 1 year worth of logs is = 365 days x 24 hours x 3600 seconds x 1 (one!!!) busy firewall with 100 log messages each second x 200 bytes per message average (e.g. valid for PIX and ASA devices) = 588 gigabytes / year of raw log data uncompressed (assuming 10x compression you'd get about 60GB of compressed log data per year)

Store it in RDBMS? Multiple it by 2-3. Have an index? Add about 30%.

The bottom line is: terabyte is the unit to measure logs.

Q4: At the organizations that have successfully implemented enterprise-wide logging, how logging impacted network and system performance?

A4: Too broad a question, so here are a few pointers:

• logging affects performance much more on some types of systems compared to other types: most painful examples are databases where some people (can't find a link...sorry) report performance loss of up to 40% if logging all SELECT statements and other data retrieval commands (you need to log selectively on these); in other cases (e.g. web servers) there is no performance loss and logging is "always on"
• log collection: agents impact system performance (long post on this subjects): a little when they run (everybody knows this) and A LOT when they crash (few people think about it - agent software memory leaks are not uncommon); unlike agents, remote agentless log collection barely affects system performance (unless you have one of the few esoteric cases)
• log transfer and network performance: look for compressed (logs compress really well), TCP-based transfers; syslogging over UDP uncompressed has a chance of doing a pipe saturation DoS on your network. Yes, people say "use a dedicated LAN," but this is definitely wishful thinking for many. Also, raw UDP syslog in large quantities over WAN = insanity :-)

Q5: What were some successful strategies for obtaining buy-in from system owners and operators in regards to turning logging on?

A5: OK, also too broad a question, but here are some pointers:

• provide them a useful service based on their logs (e.g. performance measurement, availability monitoring, compromise detection :-), or other security metrics, etc)
• help them with their compliance mandates (e.g. create reports that they can show to the auditors that "bug" them)
• give them tools to better solve their problems (e.g. allow access to a log management tool so that can investigate issues better, search the logs, check on their users, etc)

Q6: How the organizations that have successfully implemented enterprise-wide logging dealt with unusual devices (=log sources) that have no log management vendor support?

A6: They were in massive pain - if they choose a log management vendor wrong. You need to look for vendors that have "universal log source support" with NO requirement for a custom rules or custom collector/connector/agent development. Some vendors have generic text log collectors that can grab and analyze unknown logs. Typically this is done via some form of text indexing that works across all logs, including those from unknown, vertical, esoteric or custom-developed log sources

Hope it was useful!

The fiber types (such as multi-mode, single-mode), standards (SX, LX, LH) and  connectors (LC, ST, SC) seem to be a topics that need clarification about 80% of the time when we’re working with customers on networking equipment or site surveys.

Here’s a brief review of the various types of fiber, optics, connectors and when to use what. Let’s start with the basic stuff, and move down the line.

Multi-mode vs Single-mode
First of all, we have multi-mode and single-mode fiber. Multimode has a larger diameter ‘core’ or the area in the middle the light travels through. The larger diameter- think of it as a big tunnel- lets the light take different paths, creating multiple rays, or modes. The light bounces around more, which means the connectors and splices for multimode are more forgiving than for singlemode, but the bouncing causes dispersion and fidelity loss. On the other hand, singlemode has a much smaller diameter core, giving the light one straight path, or mode, through the cable. Because of this, singlemode offers higher throughput and longer distance, but the light equipment and connectors are much more finely-tuned. Which, of course, means singlemode is much more expensive.

When you’re adding or surveying multimode fiber, you should know what core size you’re working with. The core size affects bandwidth and the maximum distance you can reliably run it. Multimode usually comes in 50- or 62.5-micron, which is the core diameter. The larger the core size, the more bandwidth you get, but the shorter distance you’ can go. To give you a general comparison, most singlemode comes in 9-micron core, which is about 1/6^th the diameter of multimode.

When to use what. In short, the fiber type you choose will depend on 1) budget and 2) distance. Mostly, you’ll use multimode for short fiber runs, between switches, to servers and possibly between buildings, if they’re adjacent. You should use singlemode when you need higher throughput or a longer distance. Here’s a quick look at the types and maximum distances for each. I’ve also included a proprietary rating, for connectors using 1550nm wavelength over singlemode fiber, to get increased distance. (Standard for singlemode is 1310).

• Multimode - up to 220m with 62.5 micron core
• Multimode - up to 550m with 50 micron core
• Singlemode - up to 5km-10km (standard, using 1310nm optics)
• Singlemode - up to 70+km* (proprietary, using 1550 nm optics)
  

Fiber Optic Standards
You’ll need to know the type of optic to specify for your network equipment. Some vendors have their own proprietary fiber optics, but the standards are 1000Base-SX for multimode, and 1000Base-LX for singlemode. You can use multimode with 1000Base-LX with the addition of a mode-conditioning cable to set the light along the correct path down the cable. LX, which is standard, uses the ~1310nm wavelength. Vendors have created 1000BASE-ZX and 1000BASE-LH, which use the 1550nm optics to obtain longer distances. Note, here we’re talking about 1-Gig fiber, not 10GbE, hence the 1000Base. We usually just refer to these as SX, LX and LH, leaving off the 1000Base- when talking about the optics.

• 1000Base-SX - multimode
• 1000Base-LX - singlemode standard (can be used over MM with mode-conditioning cable)
• 1000Base-LH - singlemode non-standard (proprietary for longer distances at 1550nm)

Connectors
Here’s the fun part, and no one remembers what connectors they have (if they even knew in the first place!). There are several out there, but you’re probably going to only ever run into three - LC, ST and SC.

I’ll start with LC since that’s usually found on switches and other current network equipment these days. LC stands for ‘Lucent Connector’ (the creator) and is the connection type on SFPs (Small Factor Pluggable) or Mini-GBICs. They’re small, and were designed to replace the SC connectors.

Since I mentioned SC, let’s go there next. SC, or ‘Standard Connector’ are the predecessor to LC, and are similar in shape, but quite a bit larger. We suggest using the mnemonic ‘Square Connector’ to remember SC.

Last- and possibly least- we have ST, which really means ‘Straight Tip’, but many folks have a better time thinking of ‘Stab and Twist’. You stick it in and lock it in place by turning the outer barrel, sort of like BNC did. And yes, I’m old enough to remember the BNC days ;)

Duplex and Simplex
Most often, you’ll be using duplex fiber, which consists of a pair of fiber for bi-directional communication. Then- of course- you would use simplex fiber cables if you only need to send data a single direction. Those applications are more specific, but they do exist.

Ordering Fiber Cables
If we’re translating all our acronyms and numbers into something we can use, then let’s talk about how you put it all together when you’re procuring cables.

For example, let’s say you’re purchasing short fiber jumpers for connecting your patch cable to your switch. Most likely, you’ll want multimode, in a short length (2meters), with LC on the end going to the switch and let’s say SC on your patch panel. In our example, we’re assuming we have 62.5micron mm fiber.

What you’ll ask for is: Fiber jumper, 2 meters, duplex, 62.5-micron multimode, LC to SC.

LC	SC	ST

These are the best images I found to demonstrate the shapes and orientation of the various duplex fiber connectors we talked about. You can find these images and descriptions at Cables To Go.

Wowzers, I said this was going to be a short one. In fact, this post was originally titled “Fiber: A Very Brief Review of Cables & Connectors” but I had to rename it ;) Oh well- now you have all the information in one place for future reference.

# # #

However, as some of you may realize from my previous postings (Vista Media Center Part 1, Part 2 and Part 3), I have been a fan of Media Center as a potential alternative to the recently-downgraded (don't get me started, even my wife lost what she considered *basic* features with the "standard" Comcast DVR downgrade) Comcast DVR.

The event that kicks this story of begins with a Poker game.  Just after Microsoft announced the new Zune line-up in October, I won a charity poker event where the prize was a custom Zune 30.  It was basically a "pearl" Zune with a special logo on the back and pre-loaded with some poker theme music that we heard during the event.  I played with it a few days, loading it with some songs and even buying a couple of recent ones from the Zune marketplace.

Then ... I discovered the killer feature ... integration with my Windows Vista Media Center.   Now, technically, this feature was not actually enabled when I discovered it.  However, it took me all of 5 minutes to find the registry mod on the Internet and enable it.  That became moot a week or so ago when the recent Zune upgrade rectified that issue, so now everyone can enjoy this feature by default.  Here is the very simple set-up instructions:

1. Install the Zune software on your media center
2. Make sure you add your "Recorded TV" folder, if it is in an odd place (mine is on an external half-TByte drive).
3. Plug in your Zune device as a guest
4. Sync recorded TV shows to your heart's content

Now, let's see why this rocks...

iPod vs Zune TV Comparison

The Apple Way...

There was much ado when the Daily Show became available on iTunes for $1 per show or $9.99 for 16 episodes (roughly 3 weeks of shows).  I browsed over to http://www.apple.com/itunes/store/tvshows.html just now and found this blurb:

Be a watercooler hero.  For as little as $1.99, you can own the latest episode of your favorite show as early as one day after it airs, or purchase past episodes that you missed (or want to watch over and over). Choose a Season Pass and get a whole season of a TV show, past or present, at a discount. Or buy Multi-Passes for shows that air every day, like The Daily Show with Jon Stewart, and enjoy a month’s worth of episodes downloaded automatically to your computer.

Well, yahoo, yipee!  Only $2 per show on your iPod, iPhone or Apple TV.

The Zune + Media Center Way ...

I record all of my favorite TV shows on my Windows Media Center.  In the evening, I plug in my Zune and choose which shows to sync for mobile watching.  For example, last night I chose the two latest episodes of Heroes which I had not gotten around to watching because of my recent Jury Duty and the holiday activities.  The Zune software automagically converts the show to 320x240 and syncs it to my Zune.

This morning on the Connector Bus to work, I watched Heroes Season 2, Episode 7, "Out of Time" and found out the surprising identity of "Adam Monroe."  I'll watch Episode 8 on the way home...

And My TV Movies Too...

And, it doesn't stop there.  As I described previously, I've been building up quite a library of TV Movies, cutting out commercials, compressing them and creating my own on-demand TV Movies library.  Since I got my Zune, I've switched to using MP4 compression with H.264 video and AAC3 audio, which gets added automatically to my Zune library and can be synced to the device... better together indeed!

With my Zune 30, this means I can load up about 50 kids movies and TV shows that I've previously recorded for those long road trips and vacations.  In fact, I can plug my Zune into the aux-video inputs in our mini-van and play directly on the integrated DVD video screen.

And it is all so easy...

I live in Snoqualmie, Washington (see Snoqualmie Falls, 2nd most visited tourist attraction) - a beautiful place to live that is about 30 minutes from Microsoft.  Quicker drive than my old commute, but physically further out, so that means more gas...

When Microsoft recently launched the free Connector Bus service, with Snoqualmie Ridge as one of the neighborhoods, I thought that it would be a good opportunity for me to support Microsoft "green" environmental efforts by driving to work less and using this service.  One of the cool things about the Connector is that they have wireless connectivity, so you can catch up on email and surf during the drive.

Separately, you may not have noticed, but two weeks ago Microsoft launched its next wave of Unified Communications software.  I installed the Communicator 2007 client last week, which basically looks like a business version of MSN Messenger.  However, it also ties into our phone systems at work *and* will make a secure connection across the internet back to a corporate gateway even when we're out of the office.   I can have it autodial my Contacts, or alternatively, I can set up my laptop as my "preferred calling device." 

This means, for example, that if I am at RSA Europe in London and logged in via the wireless Internet in the booth, and you call me at my office in Redmond, I can get a window to pop up and can answer the phone using the microphone and speaker on my laptop.  Similarly, I can initiate calls from there, so no more calling cards when I travel.

Back to my story.

This morning, I caught the Connector Bus for the first time.  I sat down, pulled out my laptop and logged into the bus' wireless network and started catching up on email.  Then, I noticed that the Communicator client had connected.  I plugged in my microphone/earpiece headset, I clicked on my wife's name and initiated a call ... she answered and there I was, riding the bus to work, surfing the Internet and talking to my wife on the phone via my laptop and it hit me ... my supergeek moment ;-)