Overview

You can use the Log Depot add-on product to securely store file-based application logs with Armor for up to 13 months. Log Depot does not provide security analysis, parsing, or awareness of log content.

Within the Armor Management Portal (AMP), you can view logs from the previous 90 days. You can view these logs and overall storage usage in the Log Search section of the Log Management screen.  

Pricing information

Log Depot's prices are based on a subscription (base) charge and an overage (tiered) charge. 

The monthly subscription charge includes up to 25GB of storage. Additional storage above 25GB will be charged on a tiered level. 

Review the following table to understand the pricing structure:

Order Log Depot

1. In the Armor Management Portal (AMP), on the left-side navigation, click Security. 
2. Click Log Management. 
3. Click Log Source. 
4. Under the table, click Activate Log Depot. 
5. Review the product information, and then click Purchase. 
6. After you begin the purchase process, you can start sending logs to Armor. 

Send logs to Armor

Windows users

To use these instructions, you must have powershell admin access.

1. Log into a server instance that contains the Armor Anywhere - Security Agent. 
2. Stop the agent with the following command: 
   • spsv armor-agent
3. Run the agent policy command to add log policies. You can use the following commands as an example: 

   • For filelog type, run C:\.armor\opt\armor policy filelog add --path C:\inetpub\logs\web1.log --category web --tags web1,iis

   • For eventlog type, run C:\.armor\opt\armor policy eventlog add --name Application --category app --tags app
   • Category is required. You must label your logs based on one of the following categories: app, db, machine-data, platform, user, or web. 
   • Tags are optional. 
4. Sync the agent's policy to the API with the following command:
   • C:\.armor\opt\armor policy filelog sync
     
5. Restart the agent with the following command: 
   • sasv armor-agent
6. (Optional) To review any Log Depot files in AMP:
   1. In the Armor Management Portal (AMP), on the left-side navigation, click Security. 
   2. Click Log Management. 
   3. Click Log Search. 

Linux users

To use these instructions, you must have sudo access. 

Review the following example to understand how to send logs to Armor: /opt/armor/armor policy filelog add --path /var/log/dpkg.log --category platform --tags Ubuntu

1. Log into a server instance that contains the Armor Anywhere - Security Agent. 
2. Stop the agent with the following command: 
   • service armor-agent stop
     
3. Run the agent policy command to add log policies. You can use the following command as example: 
   • /opt/armor/armor policy filelog add --path /var/log/app.log --category app --tags app,app1
     
     • Category is required. You must label your logs based on one of the following categories: app, db, machine-data, platform, user, or web. 
     • Tags are optional.
4. Sync the agent's policy to the API with the following command: 
   • /opt/armor/armor policy filelog sync
     
5. Restart the agent with the following command: 
   • service armor-agent start
     
6. (Optional) To review any Log Depot files in AMP:
   1. In the Armor Management Portal (AMP), on the left-side navigation, click Security. 
   2. Click Log Management. 
   3. Click Log Search. 

Review additional agent-related commands

Review the following table to better understand how to interact with the agent via the command line: 

Troubleshoot Log Search section of the Log Management screen

If you do not see any data in the Log Search section of the Log Management screen, consider that

• You did not order the Log Depot add-on product. 
• You did not properly sync Log Depot to collect your log files. 
• The selected date range does not contain any data.
• You do not have permission to view log data.
  • You must have the Write LogManagement permission enabled to access the Log Search section. Contact your account administrator to enable this permission. To learn how to update you permissions, see Roles and Permissions.