To save the table of search results as a file, click Export as CSV. This saves the table as a text file containing comma-separated values. Note that if an error occurs when exporting the data, the exported CSV file will include a line (usually as the last line of the file) starting with a zero and the details of the problem, for example, 0;description_of_the_error.
Preface
Introduction
The concepts of SSB
The philosophy of SSB
Collecting logs with SSB
Managing incoming and outgoing messages with flow-control
Receiving logs from a secure channel
Advanced Log Transfer Protocol
Network interfaces
High Availability support in SSB
Firmware in SSB
Versions and releases of SSB
Licensing model and modes of operation
Licensing benefits
License types
Licensing examples
The structure of a log message
The Welcome Wizard and the first login
The initial connection to SSB
Basic settings
Creating an alias IP address (Microsoft Windows)
Creating an alias IP address (Linux)
Modifying the IP address of SSB
Configuring SSB with the Welcome Wizard
Supported web browsers
The structure of the web interface
Network settings
User management and access control
Configuring the external interface
Configuring the management interface
Configuring the routing table
Date and time configuration
SNMP and e-mail alerts
Configuring e-mail alerts
Configuring SNMP alerts
Querying SSB status information using agents
View node ID and community
Configuring system monitoring on SSB
Configuring SNMP agent settings
Health monitoring
Preventing disk space fill up
Configuring message rate alerting
System related traps
Alerts related to syslog-ng PE
Data and configuration backups
Creating a backup policy using Rsync over SSH
Creating a backup policy using SMB/CIFS
Creating a backup policy using NFS
Creating configuration backups
Creating data backups
Encrypting configuration backups with GPG
Archiving and cleanup
Managing SSB users locally
Setting password policies for local users
Managing local usergroups
Managing SSB users from an LDAP database
Authenticating users to a RADIUS server
Authenticating users via OpenID Connect
Managing user rights and usergroups
Managing SSB
Assigning privileges to usergroups for the SSB web interface
Modifying group privileges
Finding specific usergroups
How to use usergroups
Built-in usergroups of SSB
Listing and searching configuration changes
Controlling SSB: restart, shutdown
Managing a high availability SSB cluster
Configuring message sources
Adjusting the synchronization speed
Asynchronous data replication
Redundant heartbeat interfaces
Next-hop router monitoring
Upgrading SSB
Upgrade checklist
Upgrading SSB
Upgrading an SSB cluster
Troubleshooting
Updating the SSB license
Monthly license host usage report
Exporting the configuration of SSB
Importing the configuration of SSB
Accessing the SSB console
Sealed mode
Out-of-band management of SSB
Managing the certificates used on SSB
Generating certificates for SSB
Uploading external certificates to SSB
Generating TSA certificate with Windows Certificate Authority on Windows Server 2008
Generating TSA certificate with Windows Certificate Authority on Windows Server 2012
Creating hostlist policies
Default message sources in SSB
Creating new message sources in SSB
Storing messages on SSB
Configuring your own, customized Syslog type message source
Receiving SNMP messages
Configuring the Listening address and Listening port for your Syslog type message source
Configuring the Transport options for your Syslog type message source
Configuring the Hostname and timestamp-related settings for your Syslog type message source
Configuring the Monitoring settings for your Syslog type message source
Customizing encoding for your Syslog type message source
Configuring your own, customized SQL type message source
Setting up and testing the SQL database connection of your SQL type message source
Customizing fetching messages when using your SQL type message source
Customizing the fetch query for your SQL type message source
Customizing the fetch history settings for your SQL type message source
Configuring the fetching frequency settings for your SQL type message source
Configuring the Monitoring settings for your SQL type message source
Using logstores
Creating text logspaces
Managing logspaces
Forwarding messages from SSB
Managing logspaces - Archive and backup logspaces
Assigning the SSB logspace of your choice to a custom cloud service provider data disk
Creating filtered logspaces
Creating remote logspaces
Creating multiple logspaces
Accessing log files across the network
Managing custom cloud service provider data disks for your logspaces in SSB
Possible use cases and scenarios for using custom cloud service provider data disks with SSB
Adding a new custom cloud service provider data disk to your SSB configuration
Adding a new custom cloud service provider data disk on the cloud service provider side
Removing a custom cloud service provider data disk from your SSB configuration
Increasing the size of a custom cloud service provider data disk that you use in your SSB configuration
Adding a new Microsoft Azure-managed disk as a custom cloud service provider data disk on the Microsoft Azure Portal side
Adding an additional disk in VMware ESXi as a custom cloud service provider data disk on the vSphere Client side
Adding a new custom cloud service provider data disk to your SSB configuration on the SSB side
Forwarding log messages to SQL databases
SQL templates in SSB
Forwarding log messages to remote servers
Forwarding log messages to the Microsoft Azure Sentinel cloud
Log paths: routing and processing messages
Prerequisites
Limitations
Configuring the Azure Sentinel destination: adding a new Azure Sentinel destination
Forwarding log messages to Google Pub/Sub
Prerequisites
Limitations
Configuring the Google Pub/Sub destination: adding a new Google Pub/Sub destination
Forwarding log messages to Splunk
Prerequisites
Limitations
Transport settings for the Splunk destination
HTTP connection settings
HTTPS connection settings
JSON message body
Performance-related settings
Forwarding log messages to HDFS destinations
Default logpaths in SSB
Creating new log paths
Filtering messages
Replace message parts or create new macros with rewrite rules
Find and replace the text of the log message
Parsing sudo log messages
Parsing key-value pairs
Configuring syslog-ng options
General syslog-ng settings
Time stamping configuration on SSB
Using name resolution on SSB
Setting the certificates used in TLS-encrypted log transport
Searching log messages
Using the search interface
Searching the internal messages of SSB
Customizing columns of the log message search interface
Metadata collected about log messages
Using complex search queries
Browsing encrypted logspaces
Using persistent decryption keys
Using session-only decryption keys
Assigning decryption keys to a logstore
Creating custom statistics from log data
Creating content-based alerts
Setting up alerts on the search interface
Setting up alerts on the Search > Content-Based Alerts page
Format of alert messages
Additional tools
Using the internal search interfaces
Changelogs of SSB
Configuration changes of syslog-ng peers
Log message alerts
Notifications on archiving and backups
Status history and statistics
Reports
Classifying messages with pattern databases
The structure of the pattern database
How pattern matching works
Searching for rulesets
Creating new rulesets and rules
Exporting databases and rulesets
Importing pattern databases
Using pattern parsers
Using parser results in filters and templates
Using the values of pattern parsers in filters and templates
The SSB RPC API
Monitoring SSB
Monitoring SSB's disk
Monitoring SSB's memory
Monitoring SSB's CPU
Monitoring SSB's I/O
Monitoring SSB statistics
Monitoring the HA cluster
Monitoring hardware RAID
Monitoring software RAID
Monitoring web server, root CA and TSA certificates
Troubleshooting SSB
Locating the SSB appliance in the server room
Network troubleshooting
Gathering data about system problems
Viewing logs on SSB
Collecting logs and system information for error reporting
Troubleshooting an SSB cluster
Security checklist for configuring SSB
Glossary
Understanding SSB cluster statuses
Recovering SSB if both nodes broke down
Recovering from a split brain situation
Replacing a node in an SSB HA cluster
Resolving an IP conflict between cluster nodes
Restoring SSB configuration and data
Configuring the IPMI interface from the BIOS after losing IPMI password
Incomplete TSA response received
Correct Alerting & Monitoring and Management group privilege mismatch
Exporting the results
Searching the internal messages of SSB > Using the internal search interfaces > Exporting the results
Customizing columns of the internal search interfaces
Searching the internal messages of SSB > Using the internal search interfaces > Customizing columns of the internal search interfaces
The following describes how to customize the data displayed on the interface.
To customize the data displayed on the interface
-
Navigate to the database you want to browse, for example, AAA > Accounting.
-
Click Customize Columns. A pop-up window containing the list of visible and available columns is displayed.
Figure 223: AAA > Accounting > Customize Columns — Customizing columns of the search interfaces
-
The displayed parameters are listed in the Visible columns field. All other available parameters are listed in the Available columns field.
-
To add parameters to the Visible columns field, select the desired parameter(s) and click Add.
-
To remove parameters from the Visible columns field, select the desired parameter(s) and click Remove.
-
To freeze columns (to make them permanently visible, even when scrolling horizontally), enable the Freeze option next to the desired parameter.
NOTE: To select multiple parameters, press Ctrl while clicking the items.
-
-
Click OK. The selected information is displayed.
Changelogs of SSB
The syslog-ng Store Box(SSB) appliance automatically records the activity of its users and administrators. These activities are displayed at AAA > Accounting. The following information is available:
Figure 224: AAA > Accounting — Displaying configuration changes
-
Timestamp: The date when the modification was committed in YEAR-MONTH-DAY HOUR:MINUTE:SECOND format.
-
Author: The SSB user who performed the modification.
-
Page: The main menu item that was modified (for example, Basic Settings > Management).
-
Field name: The name of the field on the page that was modified.
-
New value: The new value of the field after the modification.
-
Description: The changelog entered by the SSB administrator. Changelogs are available only if the AAA > Settings > Require commit log option was enabled at the time of the change.
-
Old value: The original value of the field.
-
Swap: Indicates if the order of objects was modified on the page (for example the order of two policies in the list).
For details on how to navigate around the user interface and interact with features such as filtering and exporting results, and customizing what data is displayed, see Using the internal search interfaces.
Configuration changes of syslog-ng peers
Peers running syslog-ng Premium Edition 3.0-6.0.x automatically send a notification to syslog-ng Store Box(SSB) when their configuration has changed since the last configuration reload or restart. Note that peers running syslog-ng Premium Edition version 7.0.x do not send such notifications. These log messages are available at Search > Peer Configuration Change. Note that the log messages do not contain the actual modification, only indicate that the configuration was modified. The following information is available:
-
Timestamp: The time stamp received in the message — the time when the log message was created in YEAR-MONTH-DAY HOUR:MINUTE:SECOND format.
-
Hostname: The hostname or IP address of the client whose configuration has been changed.
-
Version: The version number of the syslog-ng application that sent the message.
-
Sender address: The IP address of the client or relay that sent the message directly to SSB.
-
Signature: The signature of the syslog-ng client.
-
Fingerprint: The SHA-1 hash of the new configuration file.
For details on how to navigate around the user interface and interact with features such as filtering and exporting results, and customizing what data is displayed, see Using the internal search interfaces.