syslog-ng Store Box 7.0 LTS - Installation Guide

This tutorial describes the possibilities and limitations of installing syslog-ng Store Box (SSB) 7.0 LTS as a virtual appliance under a Hyper-V server.

Version 7.0 LTS of SSB has no special support for running under Hyper-V. While the basic functionality of SSB is not affected by running as a virtual appliance, the following limitations apply:

• If High Availability (HA) operation mode is required in a virtual environment, use the HA function provided by the virtual environment.

• Hardware-related alerts and status indicators of SSB may display inaccurate information, for example, display degraded RAID status.

• When running SSB under Microsoft Hyper-V, ensure that the network interfaces are actually connected to the network. When running under Hyper-V, SSB indicates on the Basic Settings > Network > Ethernet links page that there is a link, even if the network interface is configured and enabled, but not connected to the network.

• When rebooting SSB in Hyper-V, the following critical error message may appear in the event log of the Hyper-V host:

  <Virtual machine name> was reset because an unrecoverable error occurred on a virtual processor that caused a triple fault.

  This is normal, there is no problem with SSB. For details, see Triple fault in event log shows reset of Linux virtual machines.

The following describes how to install a new SSB under Hyper-V.

To install a new SSB under Hyper-V

1. Create the virtual machine for SSB using the following settings:

   • Choose Generation 1 for the virtual machine.

   • Allocate memory for the virtual machine. SSB requires a minimum of 1 GiB of memory, in addition to the memory limit of the indexed logspaces. The recommended size for the memory depends on the exact environment, but consider the following:

     • The base system requires 256 MiB.

     • The syslog-ng server running on SSB requires between 128 MiB and 1 GiB of memory, depending on the message load and on the configuration of SSB.

     • For every logspace, SSB requires additional memory to index the incoming messages. The amount of memory allocated for the indexer can be set individually for every logspace.

   • Configure a fixed size disk with at least 8 GiB space.

     About 5 GB is required for the base system, the remaining disk space is used to store data.

   • Do not use RAID for the hard disk, use the data duplication features of your virtual environment instead. That way, a single hard disk is sufficient for the system. If you need to use the built-in RAID support of SSB for some reason, use two hard disks, and SSB will automatically use them in software RAID.

     Caution: Hazard of data loss When you install or reinstall SSB in a virtual environment, always create new hard disks. Using existing hard disks can cause unexpected behavior and operational problems.

   • SSB requires that you use either 1 network card or 4 network cards. If you wish to use more than one network card, then after completing the steps of the New Virtual Machine Wizard, add the additional network cards in the Settings of the virtual machine.

     Caution: Hyper-V offers two kinds of virtual Network Adapters (NICs): Legacy and Synthetic. Due to a known issue (Hyper-V network adapters are mapped to a different eth on every boot), using Legacy and Synthetic NICs within the same configuration will result in improper network setup. If you have to use more than one NICs, we recommend using only Legacy NICs.

2. Log in to your support portal account and download the latest syslog-ng Store Box installation ISO file. Note that you need to have purchased SSB as a virtual appliance or have partner access to download syslog-ng Store Box ISO files. If you are a partner but do not see the ISO files, you can request partner access within the support portal.

3. Mount the ISO image and boot the virtual machine. Follow the on-screen instructions to install SSB.

   Once installation successfully completes, the virtual machine will restart automatically.

   In case installation fails, a message will be displayed instructing you to press Ctrl+Alt+Delete to reboot the virtual machine.