ArcSight annonce confusing L5GB, or L750MB, Log Management solution

ArcSight Inc. has annonce the release of a new version of his Log Management solution, version 5.0 of ArcSight Logger. The entry price for this update is announced at 49$.

In the “ArcSight Logger – Universal Log Management Products Descriptions” section of ArcSight Web site, we have two tabs one “DOWNLOAD” and one “SPECS“.

In the “DOWNLOAD” tab, the new product is named L750MB, and has a limit of 750 MB of logs per day, with a total searchable space of 50 GB.

In the “SPECS” tab, the another product, or the same product, is named L5GB, and has a limit of 5G of logs per day, with a maximum of 50 devices connected to the Log Management solution. No total searchable space is given for the L5GB Logger.

With an average compression rate of 10:1(dependent on data type and data source), the L750MB has the following data’s :

  • 750 MB of daily raw logs represent 75 MB daily compressed logs.
  • With a total searchable space of 50 GB, the log retention policy could be theoretically be 682 days.

In the ArcSight Logger “Product Brief” PDF. They’re is no motion of the L5G product, but only the L750MB one. The characteristic’s, in the “Product Brief” PDF file, for the L750MB are :

  • Daily Limit on Log Data : 750 MB.
  • Total searchable Space (Compressed) : 50 GB.

In the 49$ product “Terms and Conditions”, the mentioned product is the L750MB, no trace of the L5G.

  • Daily Limit on Log Data : 750MB – 3.3 (viii)
  • Total searchable Space (Compressed) : 10 GB3.3 (ix)
  • 10 devices max. – 3.3 (x)
  • 2 physical CPU max (2 dual cores, or 2 quad cores, or 2 etc.) – 3.3 (xi)

With 10 GB total searchable space (compressed) the retention policy is downgraded from 682 days to 136 days ! We can also discover new restrictions for devices and CPU.

3.3. Restrictions
(viii) process more than 750MB of incoming data per day with the Software;
(ix) use the Software to store more than 10GB of data;
(x) use the Software with more than 10 devices,

Also, what is interesting in the “Terms and Conditions” is the title of the document “THE ONE-YEAR TRIAL VERSION OF LOGGER“. Is the 49$ product an one year trial ?

Another fact how is interesting in the “Terms and Conditions”, is the restriction “3.3 (ii)“. As MSSP you don’t have the possibility to distribute, sell, sub license, rent, lease the product.
But in the press release, ArcSight has target the SMB market with this new solution. Is this product not usable by MSSP ?

The new ArcSight offer seem to be quiet interesting, but clearly confusing. Maybe the rush of ArcSight Protect 10 is the cause of all these confusions.

2 thoughts on “ArcSight annonce confusing L5GB, or L750MB, Log Management solution

  1. Hello Varun,

    Thanks for your precision. As you say it will be more clear if the spec tab & the download tab contain both L750MB and L5G. But also in the “Product Brief” PDF file how contain only the L750MB.

    Another thing how is not clear, is the difference between the “Product Brief” PDF file, the “SPECS” tab and the “Terms and Conditions”. The “Total searchable Space” are not the same, 50 GB to 10 GB.


  2. Hey Eric:

    I think you are confused between two separate products. L750MB and L5GB are 2 separate products. L750MB allows you to collect up to 750MB of data/day and L5B allows you to collect up to 5GB of data/day. The spec table ONLY lists details on all the enterprise versions and not on the ArcSight Logger – Downloadable Version. Maybe that should be added to the spec table to remove any further confusions.

Comments are closed.