Chat now with support
Chat with Support

syslog-ng Store Box 7.4.0 - Administration Guide

Preface Introduction The concepts of SSB The Welcome Wizard and the first login Basic settings User management and access control Managing SSB Configuring message sources Storing messages on SSB Forwarding messages from SSB Log paths: routing and processing messages Configuring syslog-ng options Searching log messages Searching the internal messages of SSB Classifying messages with pattern databases The SSB RPC API Monitoring SSB Troubleshooting SSB Security checklist for configuring SSB Glossary

Creating an archive policy using NFS

The NFS archive method connects to a shared directory of the target server with the Network File Share protocol.

NOTE: Backup and archive policies only work with existing shares and subdirectories.

If a server has a share at, for example, archive and that directory is empty, when the user configures archive/ssb1 (or similar) as a backup/archive share, it will fail.

  1. Navigate to Policies > Backup & Archive/Cleanup and click in the Archive/Cleanup policies section to create a new archive policy.

    Figure 72: Policies > Backup & Archive/Cleanup > Archive/Cleanup Policies — Configure cleanup and archiving

  2. Enter a name for the archive policy.

  3. Enter the time when the archive process should start into the Start time field, in HH:MM format (for example, 23:00).

  1. Select NFS from the Target settings radio buttons.

  2. Enter the domain name of the remote server into the Target server field.

  3. Enter the name of the NFS export into the Export field.

    The syslog-ng Store Box (SSB) appliance saves all data into this directory, automatically creating the subdirectories.

  4. The remote server must also be configured to accept connections from SSB.

    Add a line that corresponds to the settings of SSB to the /etc/exports file of the remote server. This line should contain the following parameters:

    • The path to the archive directory as set in the Export field of the SSB archive policy.

    • The IP address of the SSB interface that is used to access the remote server. For more information on the network interfaces of SSB, see Network settings.

    • The following parameters: (rw,no_root_squash,sync).

    Example: Configuring NFS on the remote server

    For example, if SSB connects the remote server from the 192.168.1.15 IP address and the data is saved into the /var/backups/SSB directory, add the following line to the /etc/exports file:

    /var/backups/SSB 192.168.1.15(rw,no_root_squash,sync)

  5. On the remote server, execute the following command:

    exportfs -a

    Verify that the rpc portmapper and rpc.statd applications are running.

  1. Fill the Retention time in days field. Data older than this value is archived to the external server.

    NOTE:The archived data is deleted from SSB.

  2. To receive email notifications, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator email address set on the Management tab, and include the list of the files that were backed up.

    NOTE: This email notification is sent to the administratorS email address, while the alerts are sent to the alert email address ( see Configuring system monitoring on SSB ).

  3. Click .

  4. To assign the archive policy to the logspace you want to archive, see Archiving or cleaning up the collected data.

Archiving or cleaning up the collected data

To configure data archiving/cleanup, assign an archive/cleanup policy to the logspace.

Prerequisites:

You have to configure an archive/cleanup policy before starting this procedure. For details, see Archiving and cleanup.

To configure data archiving/cleanup

  1. Navigate to Log > Spaces.

  2. Select the logspace.

  3. Select the archive/cleanup policy you want to use in the Archive/Cleanup policy field.

  4. Click .

  5. Optional: To start the archiving or clean up process immediately, click Archive now. This functionality works only after a corresponding policy has been configured.

User management and access control

The AAA menu (Authentication, Authorization, and Accounting) allows you to control the authentication, authorization, and accounting settings of the users accessing syslog-ng Store Box (SSB). The following will be discussed in the next sections:

Managing SSB users locally

By default, syslog-ng Store Box (SSB) users are managed locally on SSB. In order to add local users in SSB, all steps of the following procedure need to be completed:

  1. Create users.

    For detailed instructions on how to create local users, see Creating local users in SSB.

  2. Lock or unlock users.

    For more information on how to lock or unlock local users, see Locking or unlocking a local user on SSB.

  3. Assign users to groups.

    For details about how to add a usergroup, see Managing local usergroups.

  4. Assign privileges to groups.

    For information on how to control the privileges of usergroups, see Managing user rights and usergroups.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating