A major U.S. bank unified log collection across 500,000 sources

The bank runs retail, commercial, and investment banking for millions of customer accounts, moving billions of dollars every day. That activity spreads across numerous data centers and cloud environments, and the estate behind it is large: around 500,000 log sources running Windows, Amazon Linux, Red Hat 8 and 9, Ubuntu 20.04 and 22.04, and macOS.

Getting one consistent view of that estate meant collecting several different kinds of data — plain-text application logs, Windows Event Log channels, and Linux system logs — and normalizing them into a single format. The bank's existing tooling struggled on both counts. It pushed more data into the Security Information and Event Management (SIEM) system than analysts could use, and it took performance away from endpoints the business depends on.

Financial regulation raised the stakes. The bank needed collection it could stand behind in an audit: complete, traceable, and still available if the SIEM itself went offline. That ruled out any approach treating the SIEM as the only destination for log data.

The bank chose NXLog and deployed agents across the estate to collect application log files, Windows Event Logs, and Linux system logs. The agent-based approach gave the security team collection coverage across all 500,000 sources rather than a sample of them.

Because NXLog Platform supports Windows, Linux, and macOS natively, one collection approach worked everywhere — no separate tooling per platform, and a single configuration model for the team to maintain. The agents are light enough to run on business-critical endpoints without the overhead the bank's previous tooling introduced.

Two design choices did most of the work. First, agents filter events at the source, so only data the SOC can act on travels onward. Second, every event follows two paths: forwarded to the bank's Elastic SIEM for real-time detection and analytics, and written to local storage for redundancy and compliance audits. If the SIEM is unavailable, the audit trail survives.