Chat now with support
Chat with Support

syslog-ng Store Box 5.0.3 - Administration Guide

Preface Introduction The concepts of SSB The Welcome Wizard and the first login Basic settings User management and access control Managing SSB Configuring message sources Storing messages on SSB Forwarding messages from SSB Log paths: routing and processing messages Configuring syslog-ng options Searching log messages Searching the internal messages of SSB Classifying messages with pattern databases The SSB RPC API Troubleshooting SSB Security checklist for configuring SSB About us Third-party contributions

Supported web browsers

The SSB web interface can be accessed only using TLS encryption and strong cipher algorithms. The browser must support HTTPS connections, JavaScript, and cookies. Make sure that both JavaScript and cookies are enabled.


SSB displays a warning message if your browser is not supported or JavaScript is disabled.

If you have successfully accessed the SSB web interface using HTTPS at least once, your browser will remember this, and on any subsequent occasions, it will force you to access SSB using HTTPS, even if you try loading it through an HTTP connection. This is thanks to the HTTP Strict Transport Security (HSTS) policy, which enables web servers to enforce web browsers to restrict communication with the server over an encrypted SSL/TLS connection for a set period. Web servers declare the HSTS policy using a special Strict-Transport-Security response header field.

This might, however, cause issues in any of the following cases:

  • When the SSL certificate of SSB's web interface has expired. In this case, any attempt to access the web interface using a secure connection will fail with an error message.

  • When you switch the trusted CA-signed certificate to a self-signed certificate for SSB's web interface. As per HSTS design, a self-signed certificate is not taken to have been issued by a trusted CA, therefore any secure connections to the SSB web interface will fail with an error message.

The resolution to the above-mentioned issues is to:

  • Remove the HSTS settings in your browser. This must be done locally, in a browser-specific way. For detailed instructions, consult the support site of the browser you are using.


  • Upload a new certificate, using a different browser on a different machine. For detailed instructions on how to upload external certificates to SSB, see "Uploading external certificates to SSB" in the Administration Guide.

Supported browsers:

Mozilla Firefox 52 ESR

We also test SSB on the following, unsupported browsers. The features of SSB are available and usable on these browsers as well, but the look and feel might be different from the supported browsers. Internet Explorer 11, Microsoft Edge, and the currently available version of Mozilla Firefox and Google Chrome.

The structure of the web interface

The web interface consists of the following main sections:

Main menu: Each menu item displays its options in the main workspace on one or more tabs. Click a menu item to display the list of available tabs.

Figure 14: Structure of the web interface

User menu: Provides possibilities to change your SSB password, to log out, and disable confirmation dialogs and tooltips using the Preferences option.

Figure 15: User menu

User info: Provides information about the user currently logged in:

  • username

  • IP address of the user's computer

  • date and IP address of the user's last login

Figure 16: User info

System monitor: Displays accessibility and system health information about SSB, including the following:

Figure 17: System monitor

  • Time: System date and time.

  • Remaining time: The time remaining before the session to the web interface times out.


    To change timeout settings, navigate to Basic Settings > Management > Web interface and RPC API > Session timeout and enter the timeout value in minutes.

  • Locked: Indicates that the interface is locked by another administrator (for details, see Multiple web users and locking).

  • Modules: The status of syslog-ng running on SSB (ideally it is RUNNING).

  • License: License information if the license is not valid, or an evaluation version license has expired.

  • Raid status: The status of the RAID devices, if synchronization between the disks is in progress.

  • Active:

    • Hosts: the number of clients (log source hosts) where the log messages originate from (for example computers)

    • Senders: the number of senders where the log messages directly come from (for example, relays)

    Example: Number of hosts and senders

    For example: if 300 clients all send log messages directly to SSB the Hosts and Senders are both 300.

    If the 300 clients send the messages to 3 relays (assuming that the relays do not send messages themselves) and only the relays communicate directly with SSB then Hosts is 300, while Senders is 3 (the 3 relays).

    If the relays also send messages, then Hosts is 303, while Senders is 3 (the 3 relays).

  • HA: The HA status and the ID of the active node if two SSB units are running in a High Availability cluster. If there are redundant Heartbeat interfaces configured, their status is displayed as well. If the nodes of the cluster are synchronizing data between each other, the progress and the time remaining from the synchronization process is also displayed.

  • Average system load during the

    • Load 1: last minute

    • Load 15: last fifteen minutes

  • CPU, memory, hard disk, and swap use. Hover the mouse above the graphical bars to receive a more details in a tooltip, or navigate to Basic Settings > Dashboard for detailed reports.


    If you have installed SSB from Azure, the swap column is not available, because in this case, swap memory is not used.

The System monitor displays current information about the state of SSB. To display a history of these parameters, go to Basic Settings > Dashboard. For details, see Status history and statistics.

Elements of the main workspace

The main workspace displays the configuration settings related to the selected main menu item.

Figure 18: Main workspace

  • Commit Each page includes one or more blue action buttons. The most common action button is the Commit, which saves and activates the changes of the page.

  • / Show/Hide Details: Displays or hides additional configuration settings and options.

  • Create entry: Create a new row or entry (for example, an IP address or a policy).

  • Delete entry: Delete a row or an entry (for example, an IP address or a policy).

  • , Open/collapse lists: Open or close a list of options (for example, the list of available reports).

  • Modify entries or upload files: Edit an entry (for example, a host key, a list, and so on), or upload a file (for example a private key). These actions open a popup window where the actual modification can be performed.

  • , Position an item in a list: Modify the order of items in a list. The order of items in a list (for example, the order of log paths) is important. For example, when SSB evaluates log paths, it looks at the log paths in descending order.

Message window: This popup window displays the responses of SSB to the user's actions, for example Configuration saved successfully. Error messages are also displayed here. All messages are included in the system log. For detailed system logs (including message history), see the Troubleshooting tab of the Basic menu. To make the window appear only for failed actions, navigate to User menu > Preferences and enable the Autoclose successful commit messages option.

Figure 19: Message window

Multiple web users and locking

Multiple administrators can access the SSB web interface simultaneously, but only one of them can modify the configuration. This means that the configuration of SSB is automatically locked when the first administrator who can modify the configuration accesses a configuration page (for example, the Basic Settings, AAA, or Logs menu). The username and IP address of the administrator locking the configuration is displayed in the System Monitor field. Other administrators must wait until the locking administrator logs out, navigates to a page that is not concerned with modifying the configuration (for example, the Search page), or the session of the administrator times out. However, it is possible to access the Search and Reporting menus, or browse the configuration with only View rights (for details, see Managing user rights and usergroups).


If an administrator logs in to SSB using the local console or a remote SSH connection, access via the web interface is completely blocked. Inactive local and SSH connections time out just like web connections. For details, see Accessing the SSB console.

Related Documents