The STRUCTURED-DATA message part may contain meta-information about the syslog message, or application-specific information such as traffic counters or IP addresses. STRUCTURED-DATA consists of data elements enclosed in brackets ([]).
In the following example, you can see two STRUCTURED-DATA elements:
[exampleSDID@0 iut="3" eventSource="Application" eventID="1011"][examplePriority@0 class="high"]
An element consists of an SD-ID (its identifier), and one or more parameters. Each parameter consists of a name and a value (for example, eventID="1011").
On SSB, the parameters (name-value pairs) parsed from these elements can be searched. From the example above, the following name-value pairs are parsed:
.sdata.exampleSDID@0.iut=3
.sdata.exampleSDID@0.eventSource=Application
.sdata.exampleSDID@0.eventID=1011
.sdata.examplePriority@0.class=high
The syslog-ng application automatically parses the STRUCTURED-DATA part of syslog messages, which can be referenced in macros (see for details).
The MSG part contains the text of the message itself. The encoding of the text must be UTF-8 if the BOM character is present in the message. If the message does not contain the BOM character, the encoding is treated as unknown. Usually messages arriving from legacy sources do not include the BOM character.
The Welcome Wizard and the first login
This chapter describes the initial steps of configuring syslog-ng Store Box (SSB). Before completing the steps below, unpack, assemble, and power on the hardware. Connect at least the external network interface to the local network, or directly to the computer from which SSB will be configured.
NOTE: Due to complexity of deployment, configuration, and design, you may require assistance from One Identity Professional Services while introducing new or additional:
One Identity Professional Services is equipped and trained to evaluate the needs of any organization, and to provide configuration and architectural recommendations that help our users get the most out of any SSB version.
One Identity Professional Services offer assistance in planning and scoping for current needs, as well as recommendations for the future to ensure success.
NOTE: For details on unpacking and assembling the hardware, see Hardware specifications in the Installation Guide. For details on how to create a high availability SSB cluster, see Installing two SSB units in HA mode in the Installation Guide.
The syslog-ng Store Box (SSB) appliance can be connected from a client machine using any modern web browser.
SSB can be accessed from the local network. SSB attempts to receive an IP address automatically via DHCP. If it fails to obtain an automatic IP address, it starts listening for HTTPS connections on the 192.168.1.1 IP address. Note that certain switch configurations and security settings can interfere with SSB receiving an IP address via DHCP. SSB accepts connections via its external interface (EXT, for details on the network interfaces, see Network interfaces).
TIP: The SSB console displays the IP address the external interface is listening on.
If SSB is listening on the 192.168.1.1 address, note that the 192.168.1.0/24 subnet must be accessible from the client. If the client machine is in a different subnet (for example its IP address is 192.168.10.X), but in the same network segment, the easiest way is to assign an alias IP address to the client machine. Creating an alias IP on the client machine virtually puts both the client and SSB into the same subnet, so that they can communicate. To create an alias IP complete the following steps.
|
|
Caution:
The Welcome Wizard can be accessed only using the external network interface of SSB, as the management interface is not configured yet. |
Open the page https://192.168.1.1 from your browser and accept the certificate shown. The Welcome Wizard of SSB appears.
