If you have several SSBs located at different sites, you can view and search the logs of these machines from the same web interface without having to log on to several different interfaces.

Creating multiple logspaces can also be useful if you want to pre-filter log messages based on different aspects and then share these filtered logs only with certain user groups.

The multiple logspace aggregates the messages that arrive from the member logspaces. The new log messages are listed below each other every second.

Once configured, multiple logspaces can be searched like any other logspace on SSB. You can also create filtered logspaces that are based on the multiple logspace.

 NOTE:

The multiple logspace is only a view of the member logspaces. The log messages are still stored in the member logspaces (if the member logspace is a remote logspace, the log messages are stored on the remote SSB). Therefore you cannot alter any configuration parameters of the logspace directly. To do this, navigate to the member logspace itself.

 NOTE:

If a remote member logspace becomes inaccessible, you will not be able to view the contents of that logspace.

 NOTE:

Using multiple logspaces can decrease the performance of the appliance. If possible, manage your logspaces without using multiple logspaces (for example instead of including several filtered logspaces into a multiple logspace, use several search expressions in a filtered logspace).

Figure 103: Log > Multiple Logspaces — Multiple logspaces

To create multiple logspaces

  1. Navigate to Log > Multiple Logspaces and click .

  2. Enter a name for the logspace into the top field. Use descriptive names that help you to identify the source easily. Note that the name of the logspace must begin with a number or a letter.

  3. Select the Member Logspaces from the list. To add a new member logspace, click and select another logspace. Note that you can only select member logspaces that already exist.

  4. By default, members of the search group can view the stored messages online. Use the Access control option to control which usergroups can access the logspace. For details, see also Managing user rights and usergroups.

  5. Click Commit.