- Transaction Tracking
XpoLog tracks transactions across multiple data sources and events by unique ID correlations.
XpoLog is, among many other things, an expert at recognizing patterns. XpoLog also knows how to recognize transactions that stretch across many events and data sources and last for any amount of time. For example, XpoLog can track a specific user by “stalking” the user’s unique ID. According to all the times this unique ID is written in the logs, and what was written there, XpoLog knows how to detect this flow of events, according to the common identifier.
You can monitor the amount of time it took a user to execute a certain process / finish an operation, and this is one way to check performance of application. Also, if there is a step in the process missing (it was never logged) but the user finished the operation anyway, then this would indicate a bug in the system, such as, the user gained access to a secure application without verification.
- Pattern Discovery
Detect trends and patterns for every log message, occurrence, and distribution over time and sources.
XpoLog can track certain messages and check how often they occur in a given time frame. XpoLog runs statistical functions for each individual event message. When every event gets its own statistics, you can discover patterns in the events. For example, a certain transaction takes place at even intervals, but then, all of a sudden it begins to occur very often within a short time span, only to go back to its regular intervals. You would see a distinct curve on the graph for the given time span. You can then know what time frame you need to investigate further to find out what happened.
- Data Flow Monitoring
Monitor transactions and data flows with constraints and health rule for performance, process integrity, and quality.
The XpoLog Data Flow Monitor measures the health and integrity of the transactions logged. Putting it simple, it monitors the results of the transaction tracking.
It also triggers alerts and notifications for proactive response. It sends out system alerts to ensure the data flow.
- Log Event Correlations
Correlate log events and messages by unique IDs, data sources, threads, time sequences, and custom mathematical functions in order to monitor and report complex data structures and patterns.
Create your own rules for monitoring and discovering discrepancies. Use complex rules, location (GEO View). user ID, etc to define your own “normality” pattern. Then, when you see spikes in your search graphs you will know there was activity that out of this norm.
For example, correlate between a user ID and this user’s GEO. You can create a correlation rule that says that a user with a specific ID cannot be in two places at once. If you have an employee who swipes his/her swipe card to enter your office at a given time in NY, but then, this same employee uses his/her code to make a phone call from a phone situated in CA about the same time, then you can correlate the ID and the GEO from these events and know that at least one of them is not who he/she is pretending to be.
Log Events Correlation is all about how to do complex logic on many sources and events in order to create intelligence based on predefined correlation rules.