Page Comparison

Topics Discussed

To obtain Log Relay and to configure your account for remote log collection, you must have the following AMP permissions added to your account:

• Write Virtual Machine

• Delete Log Management

• Read Log Endpoints

• Read Log Relays

• Write Log Relays

• Delete Log Relays

You can use this document to send compliance logs to Armor's Data Lake.

Pre-Deployment Considerations

...

To create a remote Log Relay, you must already have:

• A Log Relay server on your account

  • To learn how to add Log Relay to your account, see Obtain Log Relay for Remote Log Collection

• Configured the system clock

Configure Your Device or Application

...

Configure the remote log source's logs to be sent to a designated Armor Log Relay device

If required, configure logs to be sent to a designated Armor Log Relay device over SSL/TLS:

[ req ]

default_bits       = 2048

distinguished_name = req_distinguished_name

req_extensions     = req_ext



[ req_distinguished_name ]

countryName                = <COUNTRY>

stateOrProvinceName        = <STATE>

localityName               = <CITY>

organizationName           = <COMPANY_NAME>

commonName                 = <LOG_RELAY_IP_ADDRESS>



[ req_ext ]

subjectAltName = @alt_names



[alt_names]

DNS.1   = <DNS_NAME_1>

DNS.2   = <DNS_NAME_2>

DNS.3   = <DNS_NAME_3>

Fill in the values in angle brackets above with applicable values. For <COUNTRY> us the 2-

digit ISO country code. For <STATE>. you can use the 2-digit abbreviation or the full name of

your state or province.

If the IP address of the Log Relay changes frequently or you already use a DNS hostname as

the default

 means of addressing the Log Relay, use the DNS hostname instead of the IP address

in <LOG_RELAY_IP_ADDRESS>.

Add any DNS hostnames that resolve to this Log Relay using

the alt_names

 section of the config.

 If you're not using any SANs, remove

the [alt_names]

 and [req_ext]

 sections and remove the
reference under

the [req]

 section.

Then

use openssl to request the certificate:

openssl req -new rsa:2048 -key /opt/armor/logrelay.key -nodes -out logrelay.csr -config logrelay.cnf

Note that you may need to run this command as root as the key is owned by the Log

Relay service account.

After you've generated your CSR and received the certificate from the CA, ensure that it is in

PEM format and upload it to your Log Relay machine. Ensure that is accessible to the Log Relay

service account.

Once the file is uploaded and has the correct permissions, update the override environment

file to point at the path of the new certificate. Create a file

at /etc/sysconfig/armor-logstash.

override with the following contents:

ARMOR_LOGSTASH_SSL_CERT='/path/to/cert.pem'

If you used a key other than the one included with the Log Relay, you can specify it in this

file as well:

ARMOR_LOGSTASH_SSL_KEY='/path/to/private.key'

Update the Storage Only configuration to leverage the new certificate. Note that this key must not have a password and be in PKCS8 format. You can use file

permissions and/or selinux policies to protect the key.

Update Storage Configuration Certificate

/opt/armor/logstash-{version}/config/pipeline-storage/pipeline-storage.conf

To include the following lines in the "pipeline_storage_input_tcp" configuration

ssl_enable => "true"

ssl_cert => "${ARMOR_LOGSTASH_SSL_CERT}"

ssl_key => "${ARMOR_LOGSTASH_SSL_KEY}"

ssl_verify => "false"

The final version should be: 

input {

    tcp {

        id => "pipeline_storage_input_tcp"

        port => 5141

        codec => line

        add_field => {

            "type" => "storage"

            "[logsource][relay_port]" => "5141"

        }

        ssl_enable => "true"

        ssl_cert => "${ARMOR_LOGSTASH_SSL_CERT}"

        ssl_key => "${ARMOR_LOGSTASH_SSL_KEY}"

        ssl_verify => "false"

    }

}

After creating or updating these configuration files, restart the Log Relay service:

sudo systemctl restart armor-logstash.service

Was this helpful?

Topics Discussed

...