Chat now with support
Chat with Support

syslog-ng Store Box 7.2.0 - Administration Guide

Preface Introduction The concepts of SSB The Welcome Wizard and the first login Basic settings User management and access control Managing SSB Configuring message sources Storing messages on SSB Forwarding messages from SSB Log paths: routing and processing messages Configuring syslog-ng options Searching log messages Searching the internal messages of SSB Classifying messages with pattern databases The SSB RPC API Monitoring SSB Troubleshooting SSB Security checklist for configuring SSB Glossary

Network interfaces

The syslog-ng Store Box (SSB) hardware has five network interfaces: the external, the management, the internal (currently not used in SSB), the HA, and the IPMI interface. For details on hardware installation, see "syslog-ng Store Box Hardware Installation Guide" in the Installation Guide.

External interface

The external interface is used for communication between SSB and the clients: clients send the syslog messages to the external interface of SSB. Also, the initial configuration of SSB is always performed using the external interface (for details on the initial configuration, see Configuring SSB with the Welcome Wizard). The external interface is used for management purposes if the management interface is not configured. The external interface uses the Ethernet connector labeled as 1 (or EXT).

Using a 10Gbit interface as external interface

The SSB T-10 appliance is equipped with a dual-port 10Gbit interface. You can use the 10Gbit interface instead of the regular 1Gbit external (LAN 1) interface. That way, you can use SSB without any additional changes even if your network devices support only 10Gbit, and you must connect SSB to a 10Gbit-only network. This interface has SFP+ connectors (not RJ-45) labeled A and B, or labeled 5 and 6, depending on the hardware model, and can be found right of the Label 1 and 2 Ethernet interfaces.

NOTE: Only Intel-based SFP+ transceivers are compatible with the Intel 82599EB host chipset found in SSB.

The following Intel-based optical and Direct Attached Copper (DAC) SFP+ transceivers have been tested successfully with SSB, but in the future, their compatibility with SSB is not guaranteed:

  • AOC-E10GSFPSR (optical)

  • SFP-10GE-SR (DAC)

  • FTLX8571D3BCVIT1 (DAC)

For a list of Intel-based connectors that may be compatible with the Intel 82599EB host chipset found in SSB, see the 82599-BASED ADAPTERS section on the Linux* Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters page at 82599-BASED ADAPTERS/Linux* Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters.


Do not leave any unused SFP/SFP+ transceiver in the 10Gbit interface. It may cause network outage.


Hazard of data lossOne Identity recommends using a single interface (either 1, or A) and leaving the B interface unused.

If SSB detects a link on multiple interfaces, SSB will not switch to a different interface as long as the link is detected on the currently active interface, not even in case of packet loss or other network issues.

To ensure that your configuration is future-proof and to avoid having to reconfigure your appliance in the future, it is not recommended to use the B interface. In future releases of SSB, the B interface will be used exclusively in one particular type of scenario.

Management interface

The management interface is used exclusively for communication between SSB and the auditors or the administrators of SSB. Incoming connections are accepted only to access the SSB web interface, other connections targeting this interface are rejected. The management interface uses the Ethernet connector labeled as 2 (or MGMT).

The routing rules determine which interface is used for transferring remote backups and syslog messages of SSB.

TIP: It is recommended to direct backups, syslog and SNMP messages, and email alerts to the management interface. For more information, see Configuring the routing table.

If the management interface is not configured, the external interface takes the role of the management interface.

NOTE: When deploying SSB in a virtual environment, it is sufficient to use only a single network interface. When only one network interface is defined, that interface will be the one used for management purposes, enabling access to SSB's web interface and the RPC API.

High availability interface

The high availability interface (HA) is an interface reserved for communication between the nodes of SSB clusters. The HA interface uses the Ethernet connector labeled as 4 (or HA). For details on high availability, see High Availability support in SSB.

IPMI interface

The Intelligent Platform Management Interface (IPMI) interface allows system administrators to monitor system health and to manage SSB events remotely. IPMI operates independently of the operating system of SSB.

High Availability support in SSB

High availability clusters can stretch across long distances, such as nodes across buildings, cities or even continents. The goal of HA clusters is to support enterprise business continuity by providing location-independent load balancing and failover.

In high availability (HA) mode, two syslog-ng Store Box (SSB) units (called master and slave nodes) with identical configuration are operating simultaneously. The master shares all data with the slave node, and if the master node stops functioning, the other one becomes immediately active, so the servers are continuously accessible.

You can find more information on managing a high availability SSB cluster in Managing a high availability SSB cluster.

Firmware in SSB

The syslog-ng Store Box (SSB) firmware is separated into two parts: a boot and a core firmware.

  • The boot firmware boots up SSB, provides the high availability support, and starts the core firmware.

  • The core firmware handles everything else: provides the web interface, receives and processes log messages and so on.

When you upload a new .ISO file using the SSB web interface, it updates both firmware. For details, see Upgrading SSB.

Firmware and high availability

When powering on the syslog-ng Store Box (SSB) nodes in high availability mode, both nodes boot and start the boot firmware. The boot firmware then determines which unit is the master: the core firmware is started only on the master node.

Upgrading the SSB firmware via the web interface automatically upgrades the firmware on both nodes.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating