• Support
• One Identity University
• syslog-ng Store Box
• syslog-ng Log Management Foundation Training

syslog-ng Log Management Foundation Training

• Description

  Attend this four-day syslog-ng Log Management Foundation training course to build the knowledge and skills needed to successfully install, configure, operate and troubleshoot One Identity syslog-ng Premium Edition (PE) and One Identity syslog-ng Store Box (SSB). Plus, as part of the course, you can safely hone your syslog-ng Log Management skills in simulated environments to your increase your hands-on experience before you taking on a live implementation.

  For One Identity partners, you must be certified (pass exams) to deploy solutions.

• Audience

  • Partners seeking to deploy syslog-ng Log Management • Architects and consultants who will plan, install and configure syslog-ng Log Management

• Prerequisites

  Proper knowledge of log management and experience with other log management products is helpful to follow the lab lecture-based course.
  

• Objectives

  This course covers

  • Overview of the feature-set of syslog-ng Premium Edition
  • Introduction to syslog protocols (RFC3164, RFC5424 and Eventlog)
  • Installation and basic settings of syslog-ng PE
  • Using Macros and Templates to reformat syslog messages
  • Setup filters
  • Manage syslog-ng daemon from the command line
  • Transferring messages via the network and securing them
  • Collect messages from windows machines
  • Storing messages in logstores and encrypt them.
  • Parsing messages by message parser modules and reformat them by rewrite modules
  • Store messages in SQL databases
  • Classify messages with the radix tree algorithm based patterndb
  • Advanced setting and syslog-ng internals
  • Troubleshooting syslog-ng PE
  • Overview and introduction to syslog-ng Store Box (SSB)
  • Configure and initialize by the Welcome Wizard
  • Simple settings of SSB
  • Access control on the box
  • Backup, Cleanup and archive logspaces
  • Filtering and Rewriting messages
  • MRA: message rate alerting and Reports
  • Forwarding message to external devices
  • How HA works and when to use them
  • Troubleshooting SSB and how to use the support system

• Topics

  Introduction syslog-ng PE

  • Features
  • History of syslog-ng PE
  • Protocol Overview

  Simple Settings

  • Install syslog-ng PE
  • Configuration and Licensing
  • Sources and source drivers
  • Destinations and destination drivers
  • The logpath
  • Global options

  Macros and Templates

  • What is message parsing
  • What are macros
  • What are templates and how to use them

  Filters

  • Define filters
  • Filter modules
  • Usage in the logpath
  • Flags of the logpath

  Command Line Tools

  • Command line tools to manage syslog-ng

  Networking

  • Transfer messages via the network
  • Securing the transport
  • Increase reliability

  Windows Messaging

  • Using syslog-ng Agent for windows for message forwarding
  • Collecting event logs by Windows WEC

  Logstore

  • Configuring and displaying logstore files
  • Encrypt and decrypt logstores

  Message Parsing

  • Separate message parts by parser modules

  Database support

  • Sending messages to SQL databases

  Message Content Manipulation

  • Rewriting messages and message parts

  Message Classification

  • Separate and classify messages by patterndb

  Advanced Settings

  • Syslog-ng Internals
  • Message flow and limits
  • Disk buffering
  • Monitoring syslog-ng
  • Configuration tips and tricks

  Troubleshooting syslog-ng PE

  • Troubleshooting syslog-ng settings
  • Troubleshooting syslog-ng Agent for Windows

  Introduction and Overview of SSB

  • What is SSB
  • Basic functions and benefits of the device

  Configuration and Welcome Wizard

  • Initialize your SSB
  • Getting familiar with the interface

  Simple Settings

  • Basics of SSB
  • Sources
  • Logspaces
  • The search interface
  • Sharing logspaces

  Access Control

  • Layers and methods of access control

  Backup, Cleanup and Archive

  • Methods of backup and archive
  • Setup backup
  • Perform a full backup and restore

  Filter and Rewrite messages and Parsers

  • Setup message filters and parsers
  • Configure pattern database

  Alerting Monitoring and Reports

  • Configure alerting methods
  • Configure trap cases
  • Configure reports

  Forwarding Messages

  Sending messages to syslog servers, SQL servers and HDFS

  Hight Availability

  • Introduce the HA concept
  • Setup HA clusters

  Troubleshooting SSB

  • Troubleshooting SBB devices

• Format

  • Private instructor-led training delivered at a customer-chosen site for up to 8 attendees
    
  • Public instructor-led training delivered on pre-scheduled dates at a One Identity facility

• Special Notes

  • Agenda, labs and demos show all available parts for an existing training module. Depending on the course, smaller parts of it might not be taught or performed. Typically, suitable labs must be taught but demos could be selected during a training.
  • For public trainings, if the minimum number of students has not been reached two weeks before the training date, One Identity reserves the right to cancel the course.