Chat now with support
Chat with Support

syslog-ng Store Box 7.0 LTS - Administration Guide

Preface Introduction The concepts of SSB The Welcome Wizard and the first login Basic settings User management and access control Managing SSB Configuring message sources Storing messages on SSB Forwarding messages from SSB Log paths: routing and processing messages Configuring syslog-ng options Searching log messages Searching the internal messages of SSB Classifying messages with pattern databases The SSB RPC API Monitoring SSB Troubleshooting SSB Security checklist for configuring SSB Glossary

Assigning the SSB logspace of your choice to a custom cloud service provider data disk

From syslog-ng Store Box (SSB) version 7.0 LTS, you have more options for managing data disks for your logspaces.

If you need more disk space than the disk size of your default data disk available in syslog-ng Store Box (SSB), from version 6.9.0, you can also add a custom cloud service provider data disk to your configuration. From 6.9.0, SSB supports adding a Microsoft Azure-managed disk and from 6.10.0, SSB supports adding additional disks in VMware ESXi to your SSB configuration as a custom cloud service provider data disk, and assigning the SSB logspace of your choice to it.

This section describes how you can assign the SSB logspace of your choice to a custom cloud service provider data disk.

For more information about how you can add a custom cloud service provider data disk on the cloud service provider side, see Adding a new custom cloud service provider data disk on the cloud service provider side.

For more information about adding a newly added custom cloud service provider data disk to your SSB configuration, see Adding a new custom cloud service provider data disk to your SSB configuration.

For more information about the data disk information for your newly added custom cloud service provider data disks, see Data disk information for your custom cloud service provider data disks.

Prerequisites

Assigning the SSB logspace of your choice to a custom cloud service provider data disk has the following prerequisites:

Limitations

Assigning the SSB logspace of your choice to a custom cloud service provider data disk has the following limitations:

  		•  Caution:

    HAZARD OF DATA LOSS!

    One Identity does not support decreasing the size of a Microsoft Azure or VMware ESXi managed disk added to your SSB configuration as a custom cloud service provider data disk.

  • NOTE: If you fail to assign the newly created SSB logspace of your choice to the new custom cloud service provider data disk, SSB will not automatically detect and use the new custom cloud service provider data disk to store messages on it.

  • NOTE: Resizing your custom cloud service provider data disk on the Microsoft Azure or VMware ESXi side may be quick, depending on your infrastructure, but your SSB configuration must resize the file system on your SSB side to match the resizing on the Microsoft Azure or VMware ESXi side. As a result, depending on the original size of the custom cloud service provider data disk and on the size you will expand it to, starting the virtual machine for your SSB device after you expand the size of your custom cloud service provider data disk may take a long time.

  • In version 7.0 LTS, SSB supports adding Microsoft Azure managed disks of up to 32,767 GiB storage space to your SSB device. For more information about managed data disks in Microsoft Azure, see Disk type comparison in the Microsoft Azure online documentation.

  • Transporting custom cloud service provider data disks between SSB devices is not supported.

  		•

    CAUTION: HAZARD OF DATA LOSS!

    One Identity does not support decreasing the size of an additional VMware ESXi hard disk added to your SSB configuration as a custom cloud service provider data disk.

    You can only add, remove, or resize a custom cloud service provider data disk in your configuration after shutting your SSB device down first. Hot swaps are not supported.

  • You can only add an Azure managed disk as a custom cloud service provider data disk to your SSB on the Microsoft Azure portal side.

  • SSB only accepts and detects empty disks as custom cloud service provider data disks. As a result, you can only add a newly created Azure managed disk or VMware ESXi disk as a custom cloud service provider data disk to your SSB configuration. Adding an already existing Azure managed disk (by clicking Attach existing disks on the Microsoft Azure portal) or already existing VMware ESXi disk is not supported.

  • One Identity does not support adding Microsoft Azure or VMware ESXi managed disks to your SSB logspaces as a shared disk.

  • The number of managed disks you can add on the Microsoft Azure portal depends on the type of Microsoft Azure subscription you are using.

After adding a new managed disk on your cloud service provider side, and adding it as a custom cloud service provider data disk to your SSB configuration, you have to assign the SSB logspace of your choice to a custom cloud service provider data disk.

To assign the SSB logspace of your choice to a custom cloud service provider data disk,

  1. Add a new managed disk on your cloud service provider side.

  2. Add the newly created managed disk as a custom cloud service provider data disk to your SSB configuration.

  3. Navigate to Log > Logspaces, then click to add a new logspace, and find a descriptive name for it (for example, the same name that you added for the new custom cloud service provider data disk, in this case, your-custom-data-disk).

    Figure 143: Log > Logspaces — Adding a new logspace that you will assign to the new custom cloud service provider data disk

  4. Under Log > Logspaces > <your-new-logspace-with-custom-data-disk> > Storage > Disk, select the data disk you want to use for your new logspace.

    In addition to the default SSB internal storage option, you will have more data disk options in the dropdown list, including any newly created custom cloud service provider data disks you recently added to your SSB configuration.

    Figure 144: Log > Logspaces > <your-new-logspace-with-custom-data-disk> > Storage > Disk — Selecting the data disk for your new logspace

    NOTE:

    If you set a custom cloud service provider data disk under Log > Logspaces > <your-new-logspace-with-custom-data-disk> > Storage > Disk, you can not change it after committing your logspace configuration.

    NOTE: For newly created logspaces, selecting a data disk for your logspace is required.

  5. After selecting the data disk of your choice (in this case, the custom cloud service provider data disk we added earlier, that is, your-custom-data-disk), click .

    Figure 145: Log > Logspaces > <your-new-logspace-with-custom-data-disk> > Storage > Disk — New logspace assigned to your new custom cloud service provider data disk

    NOTE:After adding a newly created custom cloud service provider data disk to your SSB configuration, and assigning the SSB logspace of your choice to it, removing the custom cloud service provider data disk from your SSB configuration has a strict order, especially if there are referenced objects tied to the custom cloud service provider data disk. For more information about the process to remove such custom cloud service provider data disks from your SSB configuration, see Removing a custom cloud service provider data disk from your SSB configuration.

    TIP: The size of the logspace is displayed in the Size row of the logspace details. To refresh the data, select Get current size.

Creating filtered logspaces

Filtered logspaces allow you to create a smaller, filtered subset of the logs contained in an existing local, remote or multiple logspace. Assigning a user group to a filtered logspace enables fine grained access control by creating a group which sees only a subset of the logs from a logspace.

You can use the same search expressions and logic as on the Search interface to create a filtered logspace. In the following example, we have configured a filtered logspace that only contains messages from syslog-ng:

NOTE: The filtered logspace is only a view of the base logspace. The log messages are still stored in the base logspace (if the base logspace is a remote logspace, the log messages are stored on the remote syslog-ng Store Box (SSB) appliance). Therefore, you cannot alter any configuration parameters of the logspace directly. To do this, navigate to the base logspace itself.

NOTE: If there are any multiple logspaces using your logspace as a member logspace, the multiple logspaces in question will be listed under Multiple logspaces using this as member. The list items are clickable links that will take you directly to the logspaces on the SSB web interface.

This list is only visible on the SSB web interface for Logspaces, Filtered Logspaces, Multiple Logspaces, and Remote Logspaces if they are member logspaces in any multiple logspaces.

Figure 146: Log > Filtered Logspaces — Filtered logspaces

To create filtered logspaces

  1. Navigate to Log > Filtered Logspaces and click .

  2. Enter a name for the logspace into the top field. Use descriptive names that help you to identify the source easily. Note that the name of the logspace must begin with a number or a letter.

  3. Choose which logspace to filter in Base logspace.

  4. Enter the search expression in the Filter field.

    You can create complex searches using wildcards and boolean expressions. For more information and practical examples, see Using complex search queries.

    NOTE: SSB only indexes the first 59 characters of every name-value pair (parameter). This has two consequences:

    • If the parameter is longer than 59 characters, an exact search might deliver multiple, imprecise results.

      Consider the following example. If the parameter is:

      .sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-12345

      SSB indexes it only as:

      .sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-

      This corresponds to the first 59 characters. As a result, searching for:

      nvpair:.sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-12345

      returns all log messages that contain:

      .sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-

    • Using wildcards might lead to the omission of certain messages from the search results.

      Using the same example as above, searching for the value:

      nvpair:*=2011-12-08T12:32:25.024+01:00-hostname-12345

      does not return any results (as the 12345 part was not indexed). Instead, you have to search for:

      nvpair:*=2011-12-08T12:32:25.024+01:00-hostname-*

      This, as explained above, might find multiple results.

  5. By default, members of the search group can view the stored messages online. Use the Access control option to control which usergroups can access the logspace. For details, see also Managing user rights and usergroups.

  6. Click .

Creating remote logspaces

The syslog-ng Store Box (SSB) appliance can access and search logspaces (including filtered logspaces) on other SSB appliances. To configure SSB to access a logspace on another (remote) SSB, set up a remote logspace.

Once configured, remote logspaces can be searched like any other logspace on SSB. You can also create filtered logspaces that are based on the remote logspace.

NOTE: Note that you cannot alter the configuration, archive, back up, or empty the contents of the logspace on the remote SSB.

NOTE: If the remote logspace becomes inaccessible, you will not be able to view the contents of that logspace.

NOTE: If there are any multiple logspaces using your logspace as a member logspace, the multiple logspaces in question will be listed under Multiple logspaces using this as member. The list items are clickable links that will take you directly to the logspaces on the SSB web interface.

This list is only visible on the SSB web interface for Logspaces, Filtered Logspaces, Multiple Logspaces, and Remote Logspaces if they are member logspaces in any multiple logspaces.

Figure 147: Log > Remote Logspaces — Remote logspaces

Prerequisites:

  • You have verified that the version number of the remote SSB equals (or exceeds) the version number of the SSB where the remote logspace is created.

  • You have configured a user on the remote SSB that can access the logspace you want to reach.

  • If the logspace is encrypted, you have verified that the user has the necessary certificates.

  • You have downloaded the CA X.509 certificate of the remote SSB.

    To download the server certificate, navigate to Basic Settings > Management > SSL certificate > CA X.509 certificate, and click on the certificate.

To create remote logspaces

  1. Navigate to Log > Remote Logspaces and click .

  2. Enter a name for the logspace into the top field. Use descriptive names that help you to identify the source easily. Note that the name of the logspace must begin with a number or a letter.

  3. Enter the IP address or hostname of the remote SSB in the Host field.

  4. Enter the username of the user configured for accessing the logspace on the remote SSB in the Username field.

  5. Enter the password of the same user in the Password field.

  6. Enter the name of the logspace as it appears on the remote SSB in the Remote logspace name field.

  7. In the Remote certificate authority section, click to upload the server certificate of the remote SSB. A pop-up window is displayed.

    NOTE: It is not possible, nor required to upload a certificate chain to Remote certificate authority. The certificate chain is used by the server, not the remote logspace.

    If you want to use a certificate chain when authenticating to a remote logspace, do the following:

    1. Upload the root CA to Log > Remote Logspaces > Remote certificate authority.

    2. Upload the intermediate CA and end-entity (server) certificate to Basic Settings > Management > SSL certificate > Server X.509 certificate.

    Click Browse, select the certificate of the remote SSB, then click Upload.

  8. By default, members of the search group can view the stored messages online. Use the Access control option to control which usergroups can access the logspace. For details, see also Managing user rights and usergroups.

  9. Click .

Creating multiple logspaces

If you have several syslog-ng Store Box (SSB) appliances located at different sites, you can view and search the logs of these machines from the same web interface without having to log on to several different interfaces.

Creating multiple logspaces can also be useful if you want to pre-filter log messages based on different aspects and then share these filtered logs only with certain user groups.

Multiple logspaces aggregate the messages that arrive from the member logspaces within the group. The new log messages are listed below each other every second.

Once configured, multiple logspaces can be searched like any other logspace on SSB. You can also create filtered logspaces that are based on the multiple logspaces.

NOTE: Multiple logspaces are only a view of the member logspaces. The log messages are still stored in the member logspaces (if the member logspace is a remote logspace, the log messages are stored on the remote SSB). As a result, you cannot alter any configuration parameters of the logspace directly. To do this, navigate to the member logspace itself.

NOTE: If a remote member logspace becomes inaccessible, you will not be able to view the contents of that logspace.

NOTE: Using multiple logspaces may decrease the performance of the appliance. If possible, manage your logspaces without using multiple logspaces (for example, instead of including several filtered logspaces into a multiple logspace, use several search expressions in a filtered logspace).

NOTE: If there are any multiple logspaces using your logspace as a member logspace, the multiple logspaces in question will be listed under Multiple logspaces using this as member. The list items are clickable links that will take you directly to the logspaces on the SSB web interface.

This list is only visible on the SSB web interface for Logspaces, Filtered Logspaces, Multiple Logspaces, and Remote Logspaces if they are member logspaces in any multiple logspaces.

Figure 148: Log > Multiple Logspaces — Creating multiple logspaces

To create multiple logspaces

  1. Navigate to Log > Multiple Logspaces and click .

  2. Enter a name for the multiple logspace. Use descriptive names that help you to identify the source easily.

    NOTE: When naming your multiple logspace, consider that the name of your multiple logspace must begin with either of the following:

    • a letter of the English alphabet

    • a number

    • an underscore (_)

    • a hyphen (-)

  3. Select the Member logspaces from the list. To add a new member logspace, click and select a different logspace.

    NOTE: Consider the following:

    • You can only select logspaces that you previously configured as a local logspace / filtered logspace / remote logspace / multiple logspace.

    • You cannot add a multiple logspace to itself, only to a different multiple logspace. For example, you cannot add multiple_ls as a member of your multiple_ls multiple logspace.

    • You can add several of the same logspace types (that is, local / filtered / remote / multiple logspaces), but you cannot add the same unique logspace more than once.

  4. Under Advanced configuration, set the pool size of the concurrent remote requests for the configured multiple logspaces. The default value is 2, and the minimum configurable value is 1.

    NOTE: Consider the following:

    • Higher pool size settings may increase search speed in remote logspaces.

    • The Pool size of concurrent remote requests value is set per multiple logspace.

    • SSB only accesses remote logspaces parallelly. Parallel access is not effective for the following types of member logspaces:

      • filtered logspaces (even if the base of the filtered logspace is a remote logspace)

      • multiple logspaces

      • local logspaces

    • If more than one member remote logspace within the multiple logspace is located on the same remote SSB, then one of the following scenarios are possible:

      • The parallel or concurrent remote requests may result in performance issues on the remote SSB appliance.

      • Increasing the Pool size of concurrent remote requests value may affect search speed for remote logspaces located on the same remote host.

    • Increasing the Pool size of concurrent remote requests value will increase your network usage.

    • SSB handles each member remote logspace request per remote logspace, as a single element of the available pool. As a result, setting the Pool size of concurrent remote requests value to the same value as the number of member remote logspaces may increase your search speed, but setting it any higher will not increase your search speed further.

  5. By default, members of the search group can view the stored messages online. Use the Access control option to control which usergroups can access the logspace. For details, see also Managing user rights and usergroups.

  6. Click .

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating