syslog-ng™ Store Box
High Performance Log Management Appliancesyslog-ng™ Store Box (SSB) is a highperformance, high reliability log management
appliance that builds on the strengths ofsyslog-ng™ Premium Edition. With SSB,
you can collect and index log data, perform
complex searches, secure sensitive information
with granular access policies, generate reports
to demonstrate compliance, and forward log
data to 3rd party analysis tools.

Highlights• High performance collection and indexing• Filtering, parsing, rewriting, normalization• Rapid search through billions of messages• Alerts based on automated search queries• Easy integration with 3rd party tools via
REST API• Secure, encrypted transport and storage• Granular role-based access control• Multi-logspace searches

Learn more

Collect and index log data at
unparalleled speeds
SSB uses the syslog-ng™ Premium Edition as log collection agents.
Installers are available for 50+ platforms, including the most popular Linux
distributions, commercial versions of UNIX and Windows. Depending on its
configuration syslog-ng™ can collect up to 650,000 messages per second.
The syslog-ng™ Store Box’s indexing engine is optimized for performance.
Depending on its exact configuration, one syslog-ng™ Store Box can collectand index up to 100,000 messages per second for sustained periods. A
single SSB can collect log messages from more than 10,000 log sources
when deployed in a client-relay configuration.

Search, troubleshoot, and report• Read more about syslog-ng™ Store Box

With SSB’s full-text search, you can search through billions of logs inseconds via the intuitive web-based user interface. Wildcards and Boolean
operators allow you to perform complex searches and drill down on theresults. It offers an automatic search functionality for quicker detection ofanomalies: SSB is able to search on the incoming log data and sends analert when a critical event is detected.

• Request an evaluation• Request a callback

Users can easily create customized reports to demonstrate compliance withstandards and regulations such as PCI-DSS, ISO 27001, SOX and HIPAA.

Filter and normalize

syslog-ng™ Store Box

Databases
FilterXNetworkDevicesIndex

SearchLog Analysis

YNormalizeStoreReportSIEM

Archive

SSB offers flexible filtering capabilities based on message meta-data andmessage content to reduce the noise generated in high traffic environments
and segment data for better search and analysis.
The PatternDB™ can classify incoming logs in real-time based on message
content, extract named information elements from unstructured log messages,
allowing you to aggregate disparate log formats to search and generatestatistics.
Parsing and rewriting capabilities allow you to transform and normalize logs
based on filters and PatternDB™ results to enable effective search and analysis.

www. sys l o g - n g .co m

Store and forward
With SSB you can store large amounts of log data, create
automated retention policies, and backup data to remoteservers. The largest SSB appliance can store up to 10
terabytes of uncompressed data.
SSB provides automatic data archiving to remote servers.
The data on the remote server remains accessible andsearchable; several terabytes of audit trails can be accessedfrom the SSB webinterface. SSB uses the remote server as
a network drive via the Network File System (NFS) or theServer Message Block (SMB/CIFS) protocol.
You can also forward logs to 3rd party analysis tools orfetch data from SSB via its REST API. You can access theAPI using a RESTful protocol over HTTPS, meaning that you
can use any programming language that has access to a
RESTful HTTPS client to integrate SSB into your environment,
including popular languages such as Java and Python.

Secure your log dataLogs can be transferred from syslog-ng™ Premium Edition
clients to SSB using Transport Layer Security (TLS)
encryption, protecting any sensitive data. TLS allows themutual authentication of the host and the server using X.509
certificates.
SSB’s Logstore stores log data in encrypted, compressed,
and timestamped binary files, restricting access to authorized
personnel only.

provide granular access control restricting access to the SSB
configuration and stored logs based on usergroup privileges.
SSB can be integrated with LDAP and Radius databases.

Search across multiple
logspaces, appliances andlocations
SSB collects and indexes logs in virtual containers called
logspaces that enable organizations to segment their log
data based on any number of criteria and restrict access tologs based on user profiles. With the multi-logspace searchfeature, you can search log data in multiple logspaces
whether on the same SSB appliance or located on a different
appliance even in a remote location. The ability to searchacross multiple appliances offers organizations the option
to scale out their log management by adding additional
appliances in a costs effective way.

Licensing and support
Licensing is based on the number of Log Source Hosts (LSH)that send logs to the SSB and its hardware configuration.
There are no license limits on the amount or rate of dataprocessed or stored, making project budgeting easy.

High Availability
SSB can be deployed in a high availability configuration.
In this case, two SSB units (a master and a slave) having
identical configuration operate simultaneously.

Authentication, Authorization and Accounting settings

Appliance Specifications
ProductUnit

Redundant
PSU

Processor

MemoryUsableStorage

RAID

IPMI

3000

1

Yes

Intel Xeon E3-1275 3.60 Ghz
4 Core2 x 16 GB

6 TB

LSI MegaRAID SAS 9361-4

2.0

3500

1

Yes

2 x Intel Xeon Silver 4110
2.1 Ghz 8 Core8 x 8 GB

12 TB

LSI Avago CacheVault Power
Module 02 (CVPM02) Kit

2.0

Virtual Appliance
SSB-VA

Virtual Appliance

VMWare ESXi/ESX

Microsoft Hyper-V

Amazon Web Services

Microsoft Azure

About One Identity
One Identity helps organizations get identity and access management (IAM) right. With our unique combination of offerings,
including a portfolio of identity governance, access management, privileged management and identity as a service solutions,organizations can achieve their full potential – unimpeded by security, yet safeguarded against threats. Learn more at
OneIdentity.com© 2019 One Identity LLC ALL RIGHTS RESERVED. One Identity, and the One Identity logo are trademarks and registered trademarks of One Identity
LLC in the U.S.A. and other countries. For a complete list of One Identity trademarks, please visit our website at www.oneidentity.com/legal. All othertrademarks, servicemarks, registered trademarks, and registered servicemarks are the property of their respective owners.
ssb_uc_flyer_en08_RS_A4_41702

www. sys l o g - n g .co m