We ran LogRhythm on-prem for years. The tipping point wasn't cost—it was the sheer operational drag. Maintaining the VMs, patching, managing storage for hot/warm/cold data, and tuning the correlation rules became a full-time job for two engineers. We moved to a managed SOC service last quarter.
What we don't miss:
* The `lrserver` service hanging after a patch, requiring a manual restart sequence.
* Writing and maintaining endless watchlists and AIE rules that broke after minor log source updates.
* The constant storage tier juggling act.
What we miss:
* The raw, unfiltered query access. Need to pull a weird, specific regex pattern from 90 days ago? With the SOC portal, you're filling out a request form and waiting.
* The depth of control over parsing and normalization. Their generic parsers are... fine. Ours were better.
* The feeling you could *see* everything, even if you were drowning in it.
The trade-off is simple: we traded capability for headcount. The SOC service is a black box that sends us alerts. It works, but it feels like going from building your own monitoring stack to using a SaaS dashboard. You lose the gears.
Keep it simple