| Note |
|---|
To fully use this screen, you must add the following permissions to your account: - Read Log Management
- Write Log Management
- Read Log Management Plan Selection
- Write Log Management Plan Selection
|
You can use the Log & Data Management screen to: - View storage consumption in the Summary section
- View the status of the logging subagent in the Agent Sourcessection
- View the status and configure existing sources and add new sources in the External Sources section
- For documentation on adding or configuring external sources, click here
- View or change your storage plan in the Log Storage Plans section
By default, Armor collects and retains the following log types for 30 days: CentOS/RHEL | Ubuntu/Debian | Windows |
|---|
/var/log/secure /var/log/messages /var/log/audit.log /var/log/yum.log | /var/log/auth.log /var/log/syslog | System Event Log Security Event Log |
Using the Armor Management Portal (AMP)
| Anchor |
|---|
| View logging subagent status |
|---|
| View logging subagent status |
|---|
|
View Logging Subagent StatusYou can use these instructions toreview the logging status of your virtual machines. Specifically, you can verify if your virtual machine is sending logs to Armor. - In the Armor Management Portal (AMP), in the left-side navigation, click Security.
- Click Log & Data Management.
ClickAgent Sources.
Column | Description |
|---|
| Name | This column displays the name of the virtual machine or instance that contains the Armor agent. You can click a specific virtual machine to access theVirtual Machinesscreen. | | Type | This column displays if the virtual machine or instance has been converted to a log collecting device, also known as LogRelay. | | Last Log Received | This column displays the date and time when Armor last received a log. | | Retention Type | This column displays the length of time that Armor keeps logs.
By default, the Armor Management Portal (AMP) retains log status and details for the previous 30 days. To review logs older than 30 days for a specified instance, seeReview log retention plans. | | Average Size | This column displays the average size of the collected logs. | | Log Status | This column displays the status of the logging subagent. - Onlineindicates the agent has sent logs within the past hour.
- Warningindicates the agent in the past 24 hours has sent logs that exceeds the 7-day moving average by 10% or more.
- Criticalindicates the agent has not sent logs within the past hour.
- Offlineindicates the agent (or the instance) is offline.
|
| Anchor |
|---|
| Review log retention plans |
|---|
| Review log retention plans |
|---|
|
Review Log Retention Plans| Plan name | Log retention rate | Description |
|---|
| Log Management Essentials | 30 days | This plan collects and stores your default log types for 30 days, which you can view in AMP. By default, users are automatically subscribed to this plan. | Note |
|---|
To make sure that you do not pass the default log collection limit, Armor recommends that you review the: - Daily Log Storage Usage graph in the Summary section
- Total Log Storage graph in the Retention Plan section
|
| | Compliance Professional | 13 months | This plan collects and stores your default log types for 13 months at an additional cost. Logs from the previous 30 days are visible in AMP; however, to view logs older than 30 days, you must send a support ticket. | Note |
|---|
For existing virtual machines: After you select this plan, existing virtual machines will not be automatically enrolled in this plan; you must update each virtual machine separately. To learn more, see Upgrade log retention for existing virtual machines. |
|
| Anchor |
|---|
| View log collections projections |
|---|
| View log collections projections |
|---|
|
View Log Collections Projections| Insert excerpt |
|---|
| ESLP:View log collection projections (snippet) |
|---|
| ESLP:View log collection projections (snippet) |
|---|
| nopanel | true |
|---|
|
To learn how to submit a request to Armor Support, see Create a support ticket. Review the following requirements before submitting your log extraction request to Armor Support. Review Requirements| Requirement Type | Description |
|---|
| Supported Storage Methods | s3 bucket - A globally unique S3 bucket name must be provided to Armor Support
- Access to the S3 bucket must be provided (IAM)
- Access keys
- File type: JSON
Physical hard drive* - File type: JSON
*Physical hard drive is for Private Cloud customers only | | Unsupported Storage Methods | Armor does not support the following storage methods: - Azure Blobs
- GCP Storage
- CSV format (Excel)
|
| Info |
|---|
| Anchor |
|---|
| Troubleshooting |
|---|
| Troubleshooting |
|---|
|
TroubleshootingIf you do not see any data in the Search section or the Sources section of the Log & Data Management screen, consider that: - The selected date range does not contain any data.
- The virtual machine may be powered off.
- You do not have permission to view log data.
- You must have the ReadLogManagement permission enabled to view log data. Contact your account administrator to enable this permission. To learn how to update your permissions, see Roles and Permissions.
If you cannot add or update your plan, consider that you do not have permission to update your plans. You must have the following permissions enabled: - Read Log Management Plan Selection
- Write Log Management Plan Selection
- Read LogManagement
- Write LogManagement
|
Log and Data Management Home
Was this helpful?
| 
