The syslog-ng Store Box(SSB) appliance can be accessed using a Remote-Procedure Call Application Programming Interface (RPC API).
The SSB RPC API allows you to access and query SSB logspaces from remote applications. You can access the API using a RESTful protocol over HTTPS, meaning that you can use any programming language that has access to a RESTful HTTPS client to integrate SSB to your environment. Sample shell code snippets are provided in the API documentation.
Accessing SSB with the RPC API offers several advantages:
SSB prevents brute force attacks when logging in. If you repeatedly try logging in to SSB using incorrect login details within a short period of time (10 times within 60 seconds), the source IP gets blocked for 5 minutes.
To access syslog-ng Store Box(SSB) using the RPC API, the following requirements must be met:
-
The appliance can be accessed using a RESTful protocol over authenticated HTTPS connections.
-
The user account used to access SSB via RPC must have Search privilege (which provides access to all logspaces), or must be a member of the groups listed in the Access Control option of the particular logspace. For details on managing user privileges, see Modifying group privileges.
The client application used to access syslog-ng Store Box(SSB) must meet the following criteria:
-
Support RESTful web APIs over HTTPS
-
Properly handle complex object types
-
Include a JSON decoder for interpreting the results of search operations
The documentation of the syslog-ng Store Box(SSB) RPC API is available online from the following URL: https://<ip-address-of-SSB>/api/4/documentation. This documentation contains the detailed description of public calls, with examples. For a quickstart guide, see RPC API Quickstart Guide.
