Sentinel Log Manager has several licenses that you can use. By default, Sentinel Log Manager comes with the trial license.
The Sentinel Log Manager default licensing allows you to use all the enterprise features of Sentinel Log Manager except for the Data Restoration feature, with an unrestricted events per second (EPS) for 60 days. After the trial license expires the system runs with a base license key that enables a limited set of features and a limited event rate of 25 EPS. The base license is also known as the free license.
During the 60-day trial period, you can use the following features:
Rules: Enables you to configure rules that allow you to evaluate and filter all incoming events and deliver selected events to designated output actions. For more information, see Section 9.0, Configuring Rules and Actions.
Actions: Enables you to configure actions that get executed when one or more events meet the criteria specified by a rule. For more information, see Section 9.2, Configuring Actions.
Distributed Search: Enables you to search events and report event data not only on your local Sentinel Log Manager server, but also on other Sentinel Log Manager servers distributed across the globe. For more information, see Section 7.0, Searching and Reporting Events in a Distributed Environment.
Sentinel Link: Provides the ability to hierarchically link multiple Sentinel systems, including Sentinel Log Manager and the two Sentinel Security Information Event Management (SIEM) systems, Novell Sentinel and Novell Sentinel Rapid Deployment systems. For more information, see Section 9.2.6, Sending the Events to a Sentinel Link.
Event Store: Enables you to view the details of all the events regardless of the EPS rate.
Sentinel Log Manager comes with a free license that allows you to use a limited set of features with a limited event rate of 25 EPS. The free license does not expire.
NOTE:Novell does not provide technical support and product updates for the free version of Sentinel Log Manager.
The free version of Sentinel Log Manager includes the following features:
Collector: Allows you to use any Collector without any restriction.
Embedded Database: Stores the Sentinel Log Manager configuration data.
EPS Limited Event Store: Provides the ability to persist with the event flow even if the event view is restricted because of the expired or not licensed Event Store feature.
The following features can still be accessed with limited functionality:
Distributed Search and Report: You can add, modify, and delete the search target configurations. However, only the local event store is used for searches and reports while you are using an expired license. This applies to all distributed searches and reports, even if they were scheduled before the license expired.
Actions and Rules: You can add, modify, and delete actions and rules. However, the actions and rules will not be executed.
Sentinel Link: The Sentinel Link ESM node and actions are disabled after 60 days. Therefore, events cannot be sent or received by using Sentinel Link.
Event Store: The authorized event rate after the license expires is 25 EPS. Any events received while the system averages more than 25 EPS are stored, but the details of those events are not displayed in the search results or reports. These events are tagged with the OverEPSLimit tag. For more information, see Events View in Free Versions of Sentinel Log Manager.
All the functionality, including Data Restoration and the ability to view all events, can be restored by upgrading the system to an enterprise license. To prevent any interruption in the functionality, you must upgrade the system with the enterprise license before the expiration date.
Enterprise licenses are paid licenses that allow you to use all the Sentinel Log Manager features. The licenses are generated based on EPS: 500 EPS, 2500 EPS, and 7500 EPS.
NOTE:To purchase an enterprise license or to upgrade to a higher event rate, contact Novell Support or see How to Buy. To add the license key to the system, see Section 13.2.1, Adding a License Key.