Using persistent decryption keys
You can upload decryption keys and bind them to your account. The decryption keys are stored on syslog-ng Store Box(SSB), but they are only made available for this user account, and can also be protected (encrypted) with a passphrase.
To use persistent decryption keys
-
Select User menu > Private keystore. A pop-up window is displayed.
-
Select Permanent > 
, then select Certificate >
. A pop-up window is displayed.
Figure 216: User menu > Private keystore — Adding decryption keys to the private keystore
-
Paste or upload the certificate used to encrypt the logstore.
-
Select Key > . A pop-up window is displayed.
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-5 to upload additional keys if needed.
-
Select Security passphrase > Change, and enter a passphrase to protect the private keys.
Figure 217: User menu > Private keystore — Securing the private keystore with a passphrase
-
Click Apply.
Using session-only decryption keys
You can upload decryption keys to browse encrypted logspaces for the duration of the session only. These keys are automatically deleted when you log out from syslog-ng Store Box(SSB).
To use session-only decryption keys
-
Select User menu > Private keystore. A pop-up window is displayed.
-
Select Temporary > , then select Certificate > . A pop-up window is displayed.
Figure 218: User menu > Private keystore — Adding decryption keys to the private keystore
-
Paste or upload the certificate used to encrypt the logstore.
-
Select Key > . A pop-up window is displayed.
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-5 to upload additional keys if needed.
-
Click Apply.
Assigning decryption keys to a logstore
You can add a private key (or set of keys) to a logstore, and use these keys to decrypt the logstore files. This way, anyone who has the right to search a particular logspace can search the messages. These decryption keys are stored unencrypted in the syslog-ng Store Box(SSB) configuration file.
As this may raise security concerns, avoid this solution unless absolutely necessary.
To assign decryption keys to a logstore
-
Navigate to Log > Logspaces and select the encrypted logspace you want to make searchable for every user via the SSB web interface.
-
Select Decryption private keys > . A pop-up window is displayed.
Figure 219: Log > Logspaces — Adding decryption keys to a logstore
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-3 to upload additional keys if needed.
An additional key is needed when the certificate used to encrypt a logstore expires. When this happens, you have to upload a new certificate. However, to be able to read the logstore encrypted with the old (expired) certificate(s), you need to keep the old encryption key(s) with the new one.
-
Click 
.
Creating custom statistics from log data
The syslog-ng Store Box(SSB) appliance can create statistics from the Facility, Priority, Program, Pid, Host, Tags, and .classifier.class columns. Use Customize columns to add the required column, if necessary.
You can display statistics on the web interface, export the related data as CSV, and also save the statistics to include in a report.
