 |
|
Sawmill Analytics puts readable and actionable up-to-the-minute data in your hands, empowering your business knowledge.
You can host Sawmill wherever is most convenient for you: on a PC or a company server. Its agent-less architecture making deployment easy, while its optional Clickstream Collection System (CCS) provides a complete route to client-side clickstream analytics, putting you in control of your data collection, helping you meet regulations regarding the collection of data on web visitors.
With over 50 years combined experience in the supply of analytical reporting software Sawmill Analytics delivers what it says: "Extracting business intelligence from log files©".
As a key member of the Visidata Group we can draw on other complimentary products and services to expand our Sawmill solution portfolio into data logging and compliance, meeting the fast growing need for secure log storage and searchable reports.
|
 |
| Sawmill 8
Customizable Log Data Analytics:
- Customize the user interface
- Create your own reporting strategy
- Create custom reports with calculated columns
- Combine external metadata into reports
|
Current Version: 8.7
Supported Formats: 1022
|
Take control of your data wherever it is in your organisation. Sawmill 8 brings
many new features to help you master those server log files and create usable
and actionable reports to empower your business decision making.
Sawmill will analyse all your text log files from any source and any location producing actionable reports and alerts – condensing the data into customised dashboards to make event recognition and trend utilisation so much quicker and more effective. Every platform and every technical discipline is supported by Sawmill via its library of over 1000 different log file formats.
Web, Security, Proxy, Email, Media, IDS, Syslog, Network device, Application program, O/S events - its all logs to the Sawmill
Unlock your valuable log data and start using the business benefits you will gain
Security, Web, Media, Proxy, IDS, Email, Syslog - over 1000 different log formats
 |
Different Applications of Sawmill:
- Web Traffic Analysis
- Security Management
- Email Management
- Compliance Management
- Infrastructure Monitoring
- Streaming Media Analysis
- Server Access Management
- Database Access Management
|
Analysis without limits:
- A Sawmill license is forever
- No licensing limit on users
- No licensing limit on hits, visitors, sessions
- No licensing limit on log sizes
Sawmill products:
-
Sawmill Lite presents your data faster than any
other log file analysis solution. It removes many of
the configuration options available in the Sawmill
Professional or Sawmill Enterprise editions and in
their place substitutes a default (popular)
configuration giving you access to the data you need
right away and with the minimum of fuss.
-
Sawmill Professional is very definitely the
Professionals choice, designed with all the
configurability and power you will need to generate
and tailor your reports to meet both your, and your
users, requirements.
-
Sawmill Enterprise brings together all the power of
Sawmill Professional and adds support for the
industry-standard Oracle and MSSQL database servers
(as well as the integrated Sawmill database as used
in Lite and Professional), adds Role-based Access
Control (RBAC) and real-time log importing with
simultaneous reporting.
Download 30 Day free trial of Sawmill 8 |
Sawmill Features by Edition
1) MS SQL and Oracle supported via ODBC as a log source and a back end database
2) MySQL database as a log source is supported via ODBC and supported natively
as a back end database
3) "report features only" means that the profile's reports can be customized
through the Config section of the GUI. This is possible in all tiers except
Lite, where the Config section is limited and does not include a report editor.
"complete via Salang" means that the full Salang source code of the web
interface is open to be modified (subject to licensing restrictions - available
on request).
4)"limited" to only two role types (the built in Manager and Statistics visitor)
in Professional |
 | |
Sawmill Log Analyzer Best Practices:
Log File Management
Log files are your company’s asset and irreplaceable. We
strongly recommend that you retain
your historical log files for as long as possible. If space is a
concern consider compressing your
log files. Log files typically compress down very nicely to
anywhere between 90-98% of their
original size. Sawmill is also capable of natively reading
compressed files so there’s no need to
spend time decompressing files to process them with Sawmill.
Compressed log files also reduce
bandwidth if you are reading log files remotely, or moving files
between remote servers. The
most important reason to keep log files is to be able to rebuild
your Sawmill database in the
event of a catastrophic failure. If you retain your historical
log files recovering a database is
always possible, and it’s a simple operation to rebuild your
database. If you choose to follow
only one of the best practices and guidelines, make the choice
to retain your historical log data.
Historical logs are cheap insurance (and typically use very
little disk space when compressed)
and having them will save you from data loss if you ever need to
recover a database from the
ground up.
Backup Your Database
We strongly recommend that if you build larger datasets that you
create a backup plan for your
Sawmill databases. Having a backup of your database will save
you many hours (or even days)
of reprocessing logs and rebuilding your database in the event
of a database corruption or
catastrophic failure. Though database corruptions or failures
are infrequent, they can happen,
and if these types of situations do occur you’ll be glad you had
a backup of your Sawmill
databases so that you can be back up and running quickly.
The Sawmill internal database is a flat file database and can be
backed up by most any
commonly available backup software. It’s important that you
schedule backups when the
Sawmill database is not actively updating. If you use an
external database like MySQL, Oracle,
or MS SQL check with your Database Administrator about what
options exist for backing up or
restoring your Sawmill database.
Both the Sawmill internal database, and external databases
created by Sawmill can also be
exported to plain text files manually, and then compressed, and
later decompressed and reloaded manually if no better backup facility is available.
Profile Tuning For High Volume
A default profile created in Sawmill is optimized for maximum report generation speed. These
settings can be very problematic for very large datasets (more than 200 million lines of log data),
requiring very large amount of time and memory and disk space to build, and should be
modified before any large import begins. It is best to start by turning off most of the database
indices (all fields are indexed by default), in Config->Database Fields, and most of the crossreferences
(in Config->Cross-reference Groups). Turning off cross-reference groups will make
the database build faster, but will make the corresponding report much slower (minutes instead
of seconds). Turning off indices will make the database build faster and the database smaller,
but will make filtering on the corresponding field slower. The date/time cross-reference group
should generally be left enabled, as it is used in nearly every report, and is not very expensive.
Field complexity must also be managed for large datasets. Any normalized (non-numerical)
field with more than about 10 million unique values can become a performance liability, and
should be simplified or removed if possible. Fields can be simplified using a Log Filter, for
instance setting the field value to a single constant value if it is not needed. Database fields can
be removed completely using the command line “remove_database_field” action. During a
large database build, it is good to monitor the web interface progress display for the build (click
Show Reports on the profile), to see if there are any performance warnings appearing. These
warnings also appear in the TaskLog.
Single monolithic databases can also be a performance issue. Whenever possible very large
datasets should be segmented into separate profiles, each with its own database, for instance
one profile per server, or one profile per month, or one profile per region.
| |
Sawmill Profile Calculator
Sawmill Licensing is based
on Profiles, not on log
sources (i.e. ‘servers’). A
Profile can be considered as
a ‘Report Profile’, with a
single profile capable of
processing the log files of
one format only. A Profile
defines and manages i) the
processing of the log data,
ii) how the Sawmill database
is created, and iii) the
report style (i.e. the
tables | graphs | navigation
etc.). Although a single
profile can capture log
files from multiple sources
(provided they are all the
same format) additional
Profiles will be required if
you need to produce
additional separate
(private) reports from the
same original log file data.
Follow the two-stage process
below to determine how many
profiles and how many
licenses you need.
Step 1. Sawmill Profile
Calculator:
|
LOG FILE TYPE |
SEPERATE REPORTS |
PROFILES REQUIRED |
LICENSE PACK |
|
Web Server |
3 |
3 |
5 |
|
Proxy Server |
1 |
1 |
1 |
|
Firewall |
5 |
5 |
5 |
|
Mail Server |
2 |
2 |
5 |
|
All of the above |
11 |
11 |
25 |
Step 2. How
many copies of Sawmill do
you require?
Having calculated the number
of Profiles you need you can
now decide how many copies
of Sawmill you want to run
them on. If you decide to
run them all on a single
copy you will receive a
single key (lowest cost
option). Alternatively you
may purchase multiple
smaller licenses giving you
the right to run multiple
copies of Sawmill.
The license sizes
available for purchase are: 1, 5, 10, 25, 50, 100, 500, 1000, so the next pack size
for above 16 is 25. Customers always need some spare profiles for testing and development so the extra are always valuable.
The simple rule for calculating the number of Profiles is ‘how many regular reports do you need to produce’ and that is the number of Profiles. The minimum is the number of different log formats. So if you have
3 log formats and you want to produce 2 reports from each then you will need 6 (buy 10). On the other hand if you want one report from each then you only need 3 profiles (buy 5). One thing you can
ask is that however many reports they ‘think’ they need, they will eventually want many more. Good data always creates new requests from new people who ask ‘hey can you send me a report that shows xxxxx’
. |
|
|
|
