The syslog-ng Store Box 2 F1 Administrator Guide

4.3.1.1. Procedure – Configuring the management interface

Purpose: 

To activate the interface, complete the following steps.

Steps: 

1. Navigate to Basic Settings > Network > Interfaces.

   Figure 4.7. Configuring the management interface

   
   

2. In the Management interface field, select Enable management interface.

3. Into the Address field, enter the IP address of SSB's management interface.

4. Into the Netmask field, enter the netmask related to the IP address.

5. Warning

   After clicking Commit, the web interface will be available only via the management interface — it will not be accessible using the current (external) interface, unless the Management enabled option is selected for the external interface. Ensure that the Ethernet cable is plugged and the management interface is connected to the network; this is indicated by a green check icon in the Basic settings > Networks > Ethernet links > HA interface > Link field. When using High Availability, ensure that the management interface of both SSB units is connected to the network. The HA interface section indicates if a link is detected on the high availability interface.

   Click Commit.

4.3.1.2. Procedure – Routing management traffic to the management interface

Purpose: 

For security reasons — and also to reduce network usage on the external interface — it is recommended to direct all management-related traffic of SSB towards the management network interface. Such traffic includes access to the web interface, backups and archiving, data forwarded to a remote destination , and e-mail or SNMP alerts sent to the administrator.

	Warning
	Complete the following procedure only if the management interface is configured; otherwise the data sent by SSB will be lost. For details on configuring the management interface, see Procedure 4.3.1.1, Configuring the management interface.

Steps: 

1. To add a new routing entry, navigate to Basic Settings > Network > Interfaces and in the Routing table field, click .

   Figure 4.8. Routing

   
   

2. Enter the IP address of the backup server (as set in Procedure 4.3.5.1, Creating configuration and data backups) into the Address field.

3. Enter the related netmask into the Netmask field.

4. Enter the IP address of the gateway used on that subnetwork into the Gateway field.

5. Click Commit.

6. Repeat Steps 1-5 and create a routing entry for other backup servers if needed.

7. Repeat Steps 1-5 and create a routing entry for the SMTP server (as set in Section 4.3.3, SNMP and e-mail alerts).

8. Repeat Steps 1-5 and create a routing entry for the remote destinations (as set in Section 5.3, Forwarding messages from SSB).

4.3.2.1. Procedure – Configuring a time (NTP) server

Purpose: 

To retrieve the date automatically from a time server, complete the following steps.

Steps: 

1. Select your timezone in the Timezone field.

2. Enter the IP address of an NTP time server into the Address field.

3. Click Commit.

4. Click the and icons to add new servers or delete existing ones.

4.3.3.1. Procedure – Configuring e-mail alerts

Purpose: 

To configure e-mail alerts, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > Mail settings.

2. Enter the IP address or the hostname of the mail server into the SMTP server address field.

   Figure 4.11. Configuring e-mail sending

   
   

3. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SSB sends notifications related to system-events (but not alerts and reports) to this address.

4. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SSB sends monitoring alerts to this address.

5. Enter the e-mail address the person who should receive traffic reports from SSB into the Send reports to field. For details on reports, see Section 6.8, Reports.

6. Click Commit.

7. Click Test to send a test message.

   If the test message does not arrive to the server, check if SSB can access the server. For details, see Section 4.5.4, Troubleshooting SSB.

8. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SSB send an e-mail alert. For details, see Section 4.3.4, Configuring system monitoring on SSB.

9. Click Commit.

4.3.3.2. Procedure – Configuring SNMP alerts

Purpose: 

SSB can send alerts to a central monitoring server via SNMP (Simple Network Management Protocol). To configure SNMP alerts, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > SNMP trap settings.

2. Enter the IP address or the hostname of the SNMP server into the SNMP server address field.

   Figure 4.12. Configuring SNMP alerts

   
   

3. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 and complete the following steps:

     Figure 4.13. Configuring SNMP alerts using SNMPv3

     
     

   1. Enter the username to use into the Username field.

   2. Enter the engine ID to use into the Engine ID field. The engine ID is a hexadecimal number at least 10 digits long, starting with 0x. For example 0xABABABABAB.

   3. Select the authentication method (MD5, SHA1) to use from the Authentication method field.

   4. Enter the password to use into the Authentication password field.

   5. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

4. Click Commit.

5. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SSB send an SNMP alert. For details, see Section 4.3.4, Configuring system monitoring on SSB.

6. Click Commit.

4.3.3.3. Procedure – Querying SSB status information using agents

Purpose: 

External SNMP agents can query the status information of SSB. To configure which clients can query this information, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > SNMP agent settings.

   Figure 4.14. Configuring SNMP agent access

   
   

2. The status of SSB can be queried dynamically via SNMP. By default, the status can be queried from any host. To restrict access to these data to a single host, enter the IP address of the host into the Client address field.

3. Optionally, you can enter the details of the SNMP server into the System location, System contact, and System description fields.

4. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c agent, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 agent and complete the following steps:

   1. Click

   2. Enter the username used by the SNMP agent into the Username field.

   3. Select the authentication method (MD5, SHA1) to use from the Auth. method field.

   4. Enter the password used by the SNMP agent into the Auth. password field.

   5. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

   7. To add other agents, click .

5. Click Commit.

4.3.4.1. Procedure – Configuring monitoring

Purpose: 

To configure monitoring, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Alerting & Monitoring.

2. The default threshold values of the parameters are suitable for most situations. Adjust the thresholds only if needed.

3. Click Commit.

4. Navigate to Basic Settings > Management and verify that the SNMP settings and Mail settings of SSB are correct. SSB sends alerts only to the alert e-mail address and to the SNMP server.

   	Warning
   	Sending alerts fails if these settings are incorrect.

4.3.5.1. Procedure – Creating configuration and data backups

Purpose: 

To configure automatic configuration backups, complete the following steps:

Figure 4.16. Configuring backups and archiving

Steps: 

1. Create a backup policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Backup policies section to create a new backup policy.

   2. Enter a name for the backup policy (for example config-backup).

   3. Enter the time when the backup process should start into the Start time field in HH:MM format (for example 23:00).

   4. Enter the IP address or the hostname of the remote server into the Target server field (for example backup.example.com).

   5. Figure 4.17. Configuring backups and archiving

      
      

      SSB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Rsync over SSH: Execute the rsync command via the Secure Shell protocol. Note that the backup server must run rsync version 3.0 or newer.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

        Warning

        The CIFS implementation of NetApp storage devices is not compatible with the CIFS implementation used in SSB, therefore it is not possible to create backups and archives from SSB to NetApp devices using the CIFS protocol (the operation fails with a similar error message: /opt/scb/mnt/14719217504d41370514043/reports/2010": Permission denied (13) '2010/day/' rsync: failed to set times on). To overcome this problem, either: use the NFS protocol to access your NetApp devices, or use a backup device that has a CIFS implementation compatible with SSB, for example, Windows or Linux Samba.

      • NFS: Network File System protocol.

        	Warning
        	When using the NFS protocol to create backups or archives, ensure that the files on the remote server are readable for the www-data user as well, because SSB uses this user to access remote backups and archives if needed.

   6. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.4, Parameters of the backup protocols.

   7. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

      	Note
      	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SSB).

   8. Click Commit.

   Expected outcome: 

   A backup policy is created.

2. To use this policy to create configuration backups, navigate to Basic Settings > Management > System backup, and select the backup policy you want to use for backing up the configuration of SSB in the System backup policy field.

   Figure 4.18. Configuring system backups

   
   

   To use this policy to create data backups, navigate to Log > Spaces, select the logspace you want to backup, and select a backup policy in the Backup policy field.

3. Click Commit.

   	Tip
   	To create an immediate backup of SSB's configuration to your machine (not to the backup server), select Basic Settings > System > Export configuration. Note that the configuration export contains only the system settings and configuration files (including changelogs). System backups includes additional information like reports and alerts.

4.3.5.2. Procedure – Archiving the collected data

Purpose: 

To configure data archiving, complete the following steps.

Steps: 

1. Create an archive policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Archive/Cleanup policies section to create a new archive policy.

   2. Figure 4.19. Configuring backups and archiving

      
      

      Enter a name for the archive policy.

   3. Enter the time when the archive process should start into the Start time field in HH:MM format (for example 23:00).

   4. SSB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Only cleanup, no archiving: Do not archive data to a server, simply delete the data that is older than Retention time in days.

        	Warning
        	No archiving permanently deletes all log files and data that is older than Retention time in days without creating a backup copy or an archive. Such data is irrecoverably lost. Use this option with care.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

        Warning

        The CIFS implementation of NetApp storage devices is not compatible with the CIFS implementation used in SSB, therefore it is not possible to create backups and archives from SSB to NetApp devices using the CIFS protocol (the operation fails with a similar error message: /opt/scb/mnt/14719217504d41370514043/reports/2010": Permission denied (13) '2010/day/' rsync: failed to set times on). To overcome this problem, either: use the NFS protocol to access your NetApp devices, or use a backup device that has a CIFS implementation compatible with SSB, for example, Windows or Linux Samba.

      • NFS: Network File System protocol.

        	Warning
        	When using the NFS protocol to create backups or archives, ensure that the files on the remote server are readable for the www-data user as well, because SSB uses this user to access remote backups and archives if needed.

   5. Enter the IP address or the hostname of the remote server into the Target settings > Target server field (for example backup.example.com).

   6. Fill the Retention time in days field. Only audit data older than this value is archived to the external server.

      	Note
      	The archived data is deleted from SSB. Connection metadata is not deleted. Log files are not deleted at this point, but are rotated on a weekly basis.

   7. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.4, Parameters of the backup protocols.

   8. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

      	Note
      	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SSB).

   9. Click Commit.

   Expected outcome: 

   An archive policy is created.

2. To use this policy to archive the data of a logspace, navigate to Log > Spaces, select the logspace you want to archive, and select the archive policy you want to use in the Archive/Cleanup policy field.

3. Click Commit.

   	Tip
   	To start the archiving process immediately, click Archive now. The Archive now functionality works only after the archiving has been configured.

4.3.5.3. Procedure – Encrypting configuration backups with GPG

Purpose: 

The configuration file of SSB during system-backups, upload the public-part of a GPG key. To enable GPG-encryption, complete the following steps:

	Warning
	The regular backups of SSB contain other information (for example databases), but only the configuration file is encrypted. Note that system-backups do not contain data like logspaces .

Steps: 

1. Navigate to Basic > System > Management > System backup.

2. Select Encrypt configuration.

3. Select .

   • To upload a key file, click Browse, select the file containing the public GPG key, and click Upload. SSB accepts both binary and ASCII-armored GPG keys.

   • To copy-paste the key from the clipboard, paste it into the Key field and click Set.

   	Note
   	The GPG key you upload must be permitted to encrypt data. Keys that can be used only for signing cannot be used to encrypt the configuration file.

4. Click Commit.

4.4.6.1. Procedure – Modifying group privileges

Purpose: 

To modify the privileges of an existing group, complete the following steps:

Steps: 

1. Navigate to AAA > Access Control.

2. Find the group you want to modify and click . The list of available privileges is displayed.

3. Select the privileges (pages of the SSB interface) to which the group will have access to and click Save.

   Figure 4.30. Modifying group privileges

   
   

   	Warning
   	Assigning the Search privilege to a user on the AAA page grants the user search access to every logspace, even if the user is not a member of the groups listed in the Access control option of the particular logspace.

4. Select the type of access (read or read & write) from the Type field.

5. Click Commit.

4.4.6.2. Procedure – Creating new usergroups for the SSB web interface

Purpose: 

To create a new group, complete the following steps:

Steps: 

1. Navigate to AAA > Access Control and click .

2. Enter a name for the group. For details on how you should name your groups, see Section 4.4.6.4, How to use usergroups.

3. Click the icon located next to the name of the group. The list of available privileges is displayed.

4. Select the privileges (pages of the SSB interface) to which the group will have access to and click Save.

5. Select the type of access (read or read & write) from the Type field.

6. Click Commit.

4.5.2.3. Procedure – Configuring redundant Heartbeat interfaces

Purpose: 

In order to avoid unnecessary takeovers and minimize the chance of split-brain situations, it is possible to configure additional Heartbeat interfaces in SSB. These redundant Heartbeat interfaces are used only to detect that the other node is still available; it is not used to synchronize data between the nodes (only Heartbeat messages are transferred). For example, if the main HA interface breaks down, or is accidentally unplugged and the nodes can still access each other on the redundant HA interface, no takeover occurs, but no data is synchronized to the slave node until the main HA link is restored. Similarly, if connection on the redundant Heartbeat interface is lost, but the main HA connection is available, no takeover occurs.

The redundant Heartbeat interface is a virtual interface that uses an existing interface of the SSB device (for example the external or the management interface). The original MAC address of the interface is displayed at Basic Settings > High Availability > Interfaces for Heartbeat > Production MAC, while the MAC address of the virtual redundant Heartbeat interface is displayed at Basic Settings > High Availability > Interfaces for Heartbeat > HA MAC. The MAC address of the redundant Heartbeat interface is generated in a way that it cannot interfere with the MAC addresses of physical interfaces.

Warning

In case the nodes lose connection on the main HA interface, and after a time the connection is lost on the redundant Heartbeat interfaces as well, the slave node will become active. However, as the master node was active for a time when no data synchronization was possible between the nodes, this results in a split-brain situation which must be resolved before the HA functionality can be restored. For details, see Procedure 4.5.4.6.2, Recovering from a split brain situation.

To configure a redundant Heartbeat interface, complete the following steps.

Steps: 

1. Navigate to Basic Settings > High Availability > Interfaces for Heartbeat.

2. Select the interface you want to use as redundant Heartbeat interface (for example External). Using an interface as a redundant Heartbeat interface does not affect the original traffic of the interface.

   Figure 4.37. Configuring redundant Heartbeat interfaces

   
   

3. Enter an IP address into the This node > Interface IP field of the selected interface. This IP address must be a real IP address that is visible from the other node. The two nodes cannot have the same IP address on their redundant Heartbeat interfaces. Enter the IP address of the gateway into the Gateway IP if needed.

4. Enter an IP address into the Other node > Interface IP field of the selected interface. This IP address must be a real IP address that is visible from the other node. The two nodes cannot have the same IP address on their redundant Heartbeat interfaces. Enter the IP address of the gateway into the Gateway IP if needed.

5. Repeat the previous steps to add additional redundant Heartbeat interfaces if needed.

6. Click Commit.

   	Warning
   	For the changes to take effect, you have to restart both nodes. To restart both nodes, click Reboot Cluster.

4.5.2.5. Procedure – Configuring next-hop router monitoring

Purpose: 

By default, HA takeover occurs only if the master node stops working or becomes unreachable from the slave node. However, this does not cover the scenario when the master node becomes unaccessible to the outside world (for example its external interface or the router or switch connected to the external interface breaks down) while the slave node would be still accessible (for example because it is connected to a different router).

To address such situations, it is possible to specify IP addresses (usually next hop routers) which are continuously monitored from both the master and the slave nodes using ICMP echo (ping) messages. One such address can be set for every interface; the specified IP addresses must be on the same network segment as the respective interface of SSB. If any of the monitored addresses becomes unreachable from the master node while being reachable from the slave node (in other words, more monitored addresses are accessible from the slave node) than it is assumed that the master node is unreachable and a forced takeover occurs — even if the master node is otherwise functional.

Naturally, if the slave node is not capable of taking over the master node (for example because there is data not yet synchronized from the current master node) no takeover is performed.

To configure a next hop monitoring, complete the following steps.

Steps: 

1. Navigate to Basic Settings > High Availability > Next hop monitoring.

2. Select the interface to use for monitoring its next-hop router.

   Figure 4.38. Configuring next hop monitoring

   
   

3. Enter the IP address to monitor from the current master node (for example the IP address of the router or the switch connected to the interface) into the This node > Next hop IP field of the selected interface. This IP address must be a real IP address that is visible from the interface, and must be on the same local network segment.

4. Enter the IP address to monitor from the current slave node (for example the IP address of the router or the switch connected to the interface) into the Other node > Next hop IP field of the selected interface. This IP address must be a real IP address that is visible from the interface, and must be on the same local network segment.

5. Repeat the previous steps to add IP addresses to be monitored from the other interfaces if needed.

6. Click Commit.

   	Warning
   	For the changes to take effect, you have to restart both nodes. To restart both nodes, click Reboot Cluster.

4.5.3.2. Procedure – Updating the SSB license

Purpose: 

The SSB license must be updated before the existing license expires or when you purchase a new license. Information of the current license of SSB is displayed on the Basic Settings > System > License page. The following information is displayed:

Figure 4.40. Updating the license

SSB gives an automatic alert one week before the license expires. An alert is sent also when the number of peers exceeds 60% of the number of servers set in the Host limit parameter of the license.

To update the license, complete the following steps:

	Warning
	Before uploading a new license, you are recommended to backup the configuration of SSB. For details, see Procedure 4.5.3.3, Exporting the configuration of SSB.

Steps: 

1. Navigate to Basic Settings > System > License.

2. Click Browse and select the new license file.

3. Click Upload, then Commit.

4. To activate the new license, navigate to Traffic control > Syslog traffic and click Restart syslog-ng.

4.5.3.3. Procedure – Exporting the configuration of SSB

Purpose: 

The configuration of SSB can be exported (for manual archiving, or to migrate it to another SSB unit) from the Basic Settings > System page. Use the respective action buttons to perform the desired operation.

Figure 4.41. Exporting the SSB configuration

Steps: 

1. Navigate to Basic Settings > System > Export configuration.

2. Select how to encrypt the configuration:

   • To export the configuration file without encryption, select No encryption.

     	Warning
     	Exporting the SSB configuration without encyption is not recommended, as it contains sensitive information such as password hashes and private keys.

   • To encrypt the configuration file with a simple password, select Encrypt with password and enter the password into the Encryption password and Confirm password fields.

   • To encrypt the configuration file with GPG, select GPG encryption. Note that this option uses the same GPG key that is used to encrypt automatic system backups, and is only available if you have uploaded the public part of a GPG key to SSB at Basic > System > Management > System backup. For details, see Procedure 4.3.5.3, Encrypting configuration backups with GPG.

3. Click Export.

   	Note
   	The exported file is a gzip-compressed archive. On Windows platforms, it can be decompressed with common archive managers such as the free 7-Zip tool. The name of the exported file is <hostname_of_SSB>-YYYMMDDTHHMM.config; the -encrypted or -gpg suffix is added for password-encrypted and GPG-encrypted files, respectively.

4.5.3.4. Procedure – Importing the configuration of SSB

Purpose: 

The configuration of SSB can be imported from the Basic Settings > System page. Use the respective action buttons to perform the desired operation.

Figure 4.42. Importing the SSB configuration

	Warning
	It is not possible to import the configuration of an older major release (for example, 1.0) into a newer release (for example, 2.0).

Steps: 

1. Navigate to Basic Settings > System > Import configuration.

2. Click Browse and select the configuration file to import.

3. Enter the password into the Encryption password field and click Upload.

   Warning

   When importing an older configuration, it is possible that there are logspaces on SSB that were created after the backing up of the old configuration. In such case, the new logspaces are not lost, but are deactivated and not configured. To make them accessible again, you have to: Navigate to Log > Spaces and configure the logspace. Filling the Access Control field is especially important, otherwise the messages stored in the logspace will not be available from the Search > Logs interface. Adjust your log path settings on the Log > Paths page. Here you have to re-create the log path that was sending messages to the logspace.

4.5.4.1. Procedure – Network troubleshooting

Purpose: 

The Troubleshooting menu provides a number of diagnostic commands to resolve networking issues. Logfiles of SSB can also be displayed here — for details, see Procedure 4.5.4.3, Viewing logs on SSB.

Figure 4.43. Network troubleshooting with SSB

The following commands are available:

To execute one of the above commands, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Troubleshooting.

2. Enter the IP address or the hostname of the target host into the Hostname field of the respective command. For the Connect command, enter the target port into the Port field.

3. Click the respective action button to execute the command.

4. Check the results in the popup window. Log files are displayed in a separate browser window.

4.5.4.3. Procedure – Viewing logs on SSB

Purpose: 

The Troubleshooting menu provides an interface to view the logs generated by the various components of SSB. For details on how to browse the log messages received by SSB from its peers, see Chapter 6, Browsing log messages and SSB reports.

	Note
	Because of performance reasons, log files larger than 2 Megabytes are not displayed in the web interface. To access these logs, download the file instead.

Steps: 

1. Navigate to Basic Settings > Troubleshooting > View log files.

2. Use the Logtype roll-down menu to select the message type.

   • SSB: Logs of the SSB web interface.

   • syslog: All system logs of the SSB host.

   • syslog-ng: Internal log messages of the built-in syslog-ng server. These logs do not contain messages received from the peers.

3. • To download the log file, click Download.

   • To follow the current log messages real-time, click Tail.

   • To display the log messages, click View.

4. To display log messages of the last seven days, select the desired day from the Day: field and click View.

   	Tip
   	To display only the messages of a selected host or process, enter the name of the host or process into the Message: field. The Message: field acts as a generic filter: enter a keyword or a regular expression to display only messages that contain the keyword or match the expression.