Armor Knowledge Base
Space shortcuts
Page tree

Versions Compared

Old Version 96

changes.mady.by.user Nichelle Green

Saved on

compared with

New Version 97

changes.mady.by.user Nichelle Green

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Content Layer
id116035495
Content Column
id116035507
Content Block
background-color$lightGrayColor
id116035492

Topics Discussed

Table of Contents
maxLevel3
minLevel3

Content Block
id116035497
Note

To fully use this screen, you must add the following permissions to your account:

  • Read LogManagement
  • Write LogManagement
  • Read Log Management Plan Selection
  • Write Log Management Plan Selection

Anchor
Overview
Overview

You can use the Log & Data Management screen to:

  • View collected logs in the Search section
  • View the status of the logging subagent in the Sources section

By default, Armor collects and retains the following log types for 30 days:

CentOS/RHEL

Ubuntu/Debian

Windows

/var/log/secure

/var/log/messages

/var/log/audit.log

/var/log/audit/audit.log

/var/log/yum.log

/var/log/auth.log

/var/log/syslog

System Event Log

Security Event Log

Note

To learn how to upgrade your default log collection plan, see Review log retention plans.


Anchor
View collected logs
View collected logs
Search for Collected Logs 

Note

The Armor Management Portal (AMP) only displays logs from the previous 30 days.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security. 
  2. Click Log & Data Management. 
  3. Click Search.
    • Enter separate search terms within quotation marks.
    • Enter exact search terms, including letter capitalization.

Column

Description

DateThis column displays the date and time when Armor received the corresponding log.
SourceThis column displays the name data shows the IP address of the virtual machine that generated the log.
MessageThis column displays the specific log message.
Note

To better understand how to perform successful searches, consider the following sample log message:2019-04-08T18:46:09Z INFO No non-zero metrics in the last 30s

In a log message, spaces between words indicates a separate search term. For instance, there are no spaces in 2019-04-08T18:46:09Z. As a result, 2019-04-08T18:46:09Z is considered one search term. In this example, to search for dates, you must enter the complete and exact date; you cannot perform searches with partial search terms, such as 2019-04.

Successful search parameters

Unsuccessful search parameters

Description

  • "2019-04-08T18:46:09Z"
  • 2019
  • 2019-04-08T18:46:09Z

If the search term contains special characters, such as a colon, then you must perform the search with quotation marks ( " " ).

Also, in this example, the complete search term is 2019-04-08T18:46:09Z. You cannot perform a search on partial search terms, such as 2019.


  • "INFO"
  • INF
You cannot perform a search on partial search terms. In this example, the complete search term is INFO, not INF.
  • "metrics" "30s"
  • "metrics" "30"

You can search for different search terms by separating terms with quotation marks.

In this example, the complete search term is 30s, not 30. You cannot perform searches with partial search terms.

  • *zero *30
  • *zero 30

Similar to the use of quotation marks, you can also use an asterisk ( * ) to perform a wildcard search for strings.

A wildcard search may take a few more seconds to complete.


Anchor
View logging subagent status
View logging subagent status
View Logging Subagent Status

You can use these instructions to review the logging status of your virtual machines. Specifically, you can verify if your virtual machine is sending logs to Armor.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security. 
  2. Click Log & Data Management.
  3. Click Agent Sources.

Column

Description

Name

This column displays the name of the virtual machine or instance that contains the Armor agent. 

You can click a specific virtual machine to access the Virtual Machines screen.

TypeThis column displays if the virtual machine or instance has been converted to a log collecting device, also known as Log Relay. 
Last Log ReceivedThis column displays the date and time when Armor last received a log.
Retention Type

This column displays the length of time that Armor keeps logs.
By default, the Armor Management Portal (AMP) retains log status and details for the previous 30 days. To review logs older than 30 days for a specified instance, see Review log retention plans.

Average SizeThis column displays the average size of the collected logs.
Log Status

This column displays the status of the logging subagent.

  • Online indicates the agent has sent logs within the past hour.
  • Warning indicates the agent in the past 24 hours has sent logs that exceeds the 7-day moving average by 10% or more.
  • Critical indicates the agent has not sent logs within the past hour.
  • Offline indicates the agent (or the instance) is offline.



Anchor
View log collections projections
View log collections projections
View Log Collections Projections

Excerpt Include
ESLP:View log collection projections (snippet)
ESLP:View log collection projections (snippet)
nopaneltrue


Anchor
Review log retention plans
Review log retention plans
Review Log Retention Plans

Plan nameLog retention rateDescription
Log Management Essentials30 days

This plan collects and stores your default log types for 30 days, which you can view in AMP.

By default, users are automatically subscribed to this plan.

Note

To make sure that you do not pass the default log collection limit, Armor recommends that you review the:

  • Daily Log Storage Usage graph in the Summary section
  • Total Log Storage graph in the Retention Plan section
Compliance Professional13 months

This plan collects and stores your default log types for 13 months at an additional cost.

Logs from the previous 30 days are visible in AMP; however, to view logs older than 30 days, you must send a support ticket.

Note

For existing virtual machines:

After you select this plan, existing virtual machines will not be automatically enrolled in this plan; you must update each virtual machine separately.

To learn more, see Upgrade log retention for existing virtual machines.

Note

For future virtual machines:

After you select this plan, new virtual machines will be automatically enrolled in this plan.

To learn more, see Upgrade log retention for new virtual machines.


Anchor
Upgrade log retention for existing virtual machines
Upgrade log retention for existing virtual machines
Upgrade Default Log Retention for Existing Virtual Machines

Excerpt Include
ESLP:Upgrade log retention for existing virtual machines (snippet)
ESLP:Upgrade log retention for existing virtual machines (snippet)
nopaneltrue


Anchor
Upgrade log retention for new virtual machines
Upgrade log retention for new virtual machines
Upgrade Default Log Retention for New Virtual Machines 

You can use these instructions to update the default log retention plan for future virtual machines. In short, after you perform this step, any virtual machine you create afterwards will be automatically enrolled in the 13-month log retention plan. 

Note

For pricing information, please contact your account manager.

Note

Existing virtual machines will not be upgraded. To upgrade the log retention rate for existing virtual machines, you must update each existing virtual machine individually.

To learn more, see Upgrade log retention for existing virtual machines.

Excerpt Include
ESLP:Upgrade default log retention for new virtual machines (snippet)
ESLP:Upgrade default log retention for new virtual machines (snippet)
nopaneltrue



Anchor
Export log service status
Export log service status
Export Log Service Status

Excerpt Include
ESLP:Export log service status (snippet)
ESLP:Export log service status (snippet)
nopaneltrue



Info

Anchor
Troubleshooting
Troubleshooting
Troubleshooting

If you do not see any data in the Search section or the Sources section of the Log & Data Management screen, consider that:

  • The selected date range does not contain any data.
  • The virtual machine may be powered off. 
  • You do not have permission to view log data.
    • You must have the ReadLogManagement permission enabled to view log data. Contact your account administrator to enable this permission. To learn how to update your permissions, see Roles and Permissions.

If you cannot add or update your plan, consider that you do not have permission to update your plans. You must have the following permissions enabled:  

  • Read Log Management Plan Selection
  • Write Log Management Plan Selection
  • Read LogManagement 
  • Write LogManagement 




Related Documentation 

To learn how to collect and send additional log types to AMP, see Introduction to Log Relay.




Was this helpful?
Rate Macro

Scrolltotop




Browse by Topic



Popular Articles




Armor exists to protect. Each employee feels our passion, knows the vision and lives the company values. Diversity is key. Every role is important to Armor’s success. We volunteer our best every day and go to any length to ensure our customers are protected.

US  +1 877 262 3473  |  UK  +44 800 500 3167
©2019 Armor Defense Inc. All Rights Reserved.