Search Function Overview
CorreLog can continuously receive in excess of 5000 events per second.
This makes the need for a high-speed search engine essential in order to
find precise events embedded within massive amounts of other data.
CorreLog is designed to perform these searches as rapidly as possible,
easily returning search results across gigabytes of data within one
second. The CorreLog high-speed search capability directly supports
iteration and search refinement, especially important for data analysis
and forensics, where a single search session might consist of dozens of
CorreLog breaks each message into keywords, stores each keyword
reference, and builds a concordance of all the lines in all log messages
indicating where each keyword occurred. This "search index" furnishes
extremely rapid searches across vast amounts of data based upon keywords
Additionally, CorreLog keeps track of which data was last indexed, and
permits a non-indexed search from that point on. This means that as new
data is received, even before it is indexed, it is immediately available
for searching like any other data. Furthermore, once a keyword search
has reduced the amount of data to a manageable number of log entries,
CorreLog can apply regular expressions to quickly target the exact log
messages you are seeking.
This combination of "indexed" and "non-indexed" search furnishes unique
capabilities not found in other products. CorreLog's search facility,
designed specifically for handling log messages, yields extremely high
performance, flexibility, and unmatched functionality and features.
Index Search. We use our "GenDex" search engine to process raw
log data, keeping track of message content, as well as the message
time, IP address, facility, and severity. The "GenDex" program
periodically updates an index file that allows you to search across many
gigabytes of data, typically within one second or less.
Non-Index Search. In conjunction with the index search, we
support non-indexed searches across search results, and across data
that has not yet been indexed. This operation is transparent to the
user, and permits you to employ complex search terms using wildcards,
match and exclude patterns. You precisely and rapidly locate the
log messages you are seeking.
Keyword Concordance. The list of search keywords is available to
the operator, providing an overview of all keywords found in all
messages, so that common keywords can be investigated or ignored, and
message content can be quickly summarized. Using this unique feature,
you see all message content summarized by keyword and word counts. You
obtain a unique and powerful new perspective on your data.
Auto-complete. The operator can enter a partial keyword, and
that entry is automatically completed by CorreLog to match the nearest
full keyword. This permits you to quickly type in a few significant
characters, and have CorreLog perform a lookup of the keyword and
auto-complete the search term for you. This is particularly useful
if keywords are complex character strings, possible associated with
a user or session ID or other handle.
Advanced Search Functions. For more complex searches, CorreLog
provides an "advanced" search screen that guides the user through the
process of creating a search query consisting of full matches, partial
matches, and exclusions. Additionally, the advanced search screen
permits you to specify a range of message facilities, severities, and
times. For example, you can search for messages originating from a
small set of devices at particular times of the day, containing
certain keywords and excluding others.
Multi-Tier Search Capability
CorreLog provides its "Enterprise Search Adapter" software, to permit
searches by a supervisor across multiple CorreLog Server installations.
This optional adapter component
can be added at each CorreLog Server to assist in distributed management
of a multi-tier CorreLog implementation, greatly expanding your
ability to manage the log messages of your entire organization.
For those sites that implement multiple copies of CorreLog Server, you
can issue search requests to each CorreLog server simultaneously, and
receive the count of matching results. You can then drill down to view
the detailed search results. This provides an easy way to determine the
status of messages, or locate specific devices on your enterprise
associated with log data. The "Enterprise Search Adapter" expands the
role of CorreLog to be a full enterprise manager of a distributed
logging system. Given the formidable power of a single CorreLog site,
this multi-tier capability permits management of devices in excess of 1
million devices, and message collection rates approaching 10 million
events per second.
Complete Search Solution
In addition to the interactive search facility, CorreLog employs its
GenDex search capability in other locations within CorreLog, including
within the correlation functions, reporting functions, and ticketing
system. These areas augment CorreLog's basic search functionality
described above by establishing message taxonomies and catalogs,
and creating graphical depictions of message rates based upon search
For example, it may be more pertinent to the user to see a graph of
message counts during a period of time, matching specific message
patterns. This functionality is readily available within the "Graph"
utility of CorreLog's "Report" screens, where minute, hour, and daily
message counts (that reflect a specific keyword or phrase) are shown in
Many other specific search functions are ready-to-use within the main
CorreLog Server, including the ability to search devices by message
keyword to obtain a list of devices related by a common message phrase.
In particular, users can configure dashboards that reflect specific
"message types" and "taxonomy domains", permitting easy drill-down
from graphs into correlated message lists.
You can begin experimenting with CorreLog's unique and powerful
enterprise search functions immediately, at your enterprise. Download
our free trial package and begin viewing
your enterprise data right now. The CorreLog system installs in
minutes, and permits you to search, correlate, and report on your
enterprise data using an intuitive user interface.
View Other Solutions & Services...