syslog-ng Store Box 7.0.4 LTS - Administration Guide

You can use wildcards and boolean expressions, and search specific parts of the log messages collected on syslog-ng Store Box(SSB).

NOTE: When searching log messages, the capabilities of the search engine depend on the delimiters used to index the particular logspace. By default, the indexer uses the following delimiter characters to separate the message into words (tokens): & : ~ ? ! [ ] = , ; ( ) ' ". For details on how to configure the delimiters used for indexing, see Creating logstores in the Administration Guide.

The following sections provide examples for different search queries:

For examples of exact matches, see Searching for exact matches and using complex queries.
For examples of using boolean operators to combine search keywords, see Combining search keywords.
For examples of wildcard searches, see Using wildcard searches.
For examples of searching for special characters, see Searching for special characters.
For examples of searching in a specific part of the message, see Searching in a specific part of the message.
For examples of searching name-value pairs, see Searching the name-value pairs of the message.

Searching for exact matches and using complex queries

By default, SSB searches for keywords as whole words in the MESSAGE part of the log message and returns only exact matches.

Combining search keywords

You can use boolean operators - AND, OR, and NOT - to combine search keywords. Note that the boolean operators are case sensitive, and must be in all caps. More complex search expressions can also be constructed with parentheses.

Using wildcard searches

You can use the ? and * wildcards in your search expressions.

Searching for special characters

To search for the question mark (?), asterisk (*), backslash (\) or whitespace () characters, you must prefix these characters with a backslash (\). Any character after a backslash is handled as a character to be searched for.

NOTE: Delimiter characters are an exception to the rule. It is not possible to search for delimiter characters, even when they are prefixed.

Searching in a specific part of the message

You can search in a specific part of the message using the <type>: prefix. The message: (or msg:) prefix means the message part and can be omitted. For example, use the program: prefix to search for the name of an application, or use the host: prefix to search for a host name, and so on.

Searching the name-value pairs of the message

You can search the structured data part of log messages using the nvpair: prefix. Use the = delimiter to separate the name and the value of structured data parameters, and remove the quote marks from the values.

Search performance tips

Browsing encrypted logspaces

By default, you cannot browse encrypted logstores from the syslog-ng Store Box(SSB) web interface, because the required decryption keys are not available on SSB. To make browsing and searching encrypted logstores possible, SSB provides the following options:

Use persistent decryption key(s) for a single user.

For details, see Using persistent decryption keys.
Use decryption keys for the duration of the user session only.

For details, see Using session-only decryption keys.
Assign decryption keys to a logstore (making them available to every SSB user). This option might raise security concerns.

For details, see Assigning decryption keys to a logstore.

NOTE: Do not use SSB's own keys and certificates for encrypting or decrypting.

One Identity recommends:

Using 2048-bit RSA keys (or stronger).
Using the SHA-256 hash algorithm (or stronger) when creating the public key fingerprint.

Using persistent decryption keys

You can upload decryption keys and bind them to your account. The decryption keys are stored on syslog-ng Store Box(SSB), but they are only made available for this user account, and can also be protected (encrypted) with a passphrase.

To use persistent decryption keys

Select User menu > Private keystore. A pop-up window is displayed.
Select Permanent > , then select Certificate > . A pop-up window is displayed.

Figure 211: User menu > Private keystore — Adding decryption keys to the private keystore
Paste or upload the certificate used to encrypt the logstore.
Select Key > . A pop-up window is displayed.
Paste or upload the private key of the certificate used to encrypt the logstore.
Repeat Steps 2-5 to upload additional keys if needed.
Select Security passphrase > Change, and enter a passphrase to protect the private keys.

Figure 212: User menu > Private keystore — Securing the private keystore with a passphrase
Click Apply.

Using session-only decryption keys

You can upload decryption keys to browse encrypted logspaces for the duration of the session only. These keys are automatically deleted when you log out from syslog-ng Store Box(SSB).

To use session-only decryption keys

Select User menu > Private keystore. A pop-up window is displayed.
Select Temporary > , then select Certificate > . A pop-up window is displayed.

Figure 213: User menu > Private keystore — Adding decryption keys to the private keystore
Paste or upload the certificate used to encrypt the logstore.
Select Key > . A pop-up window is displayed.
Paste or upload the private key of the certificate used to encrypt the logstore.
Repeat Steps 2-5 to upload additional keys if needed.
Click Apply.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem