Log Manager Beats: Log Files Signature and Compression
Beats is the new method for log acquisition introduced in the latest releases of NetEye 4. It’s a system fully integrated with the Elastic Stack. The Beats agents send logs directly to Logstash, which then forwards them to Elastic. Logstash also writes each log received into files on the file system (at the same location as Rsyslog).
However, the Beats agent configuration is not yet integrated into the configuration web interface of NetEye 4 Log Manager.
To improve the integration of the Beats agents on NetEye 4 Log Manager and enable the automatic signature and compression procedure with the log files written by Logstash, you need to perform the following steps:
- Open the NetEye 4 web interface and log in
- Go to the Director module
- Create a new host template – let’s call it “beats-hosts”
- Select a “Check command” – for this guide let’s select “Ping”
- Open the “Custom properties”
- In the “Safed Profile” dropdown, select “No agent was found”
- Save the host template
- Create a new host
- Select the “beats-hosts” template
- The name of the new host must be the same as the host name of one of the hosts that sends logs to NetEye 4 via Beats (be sure to also set it correctly in the host)
- Set the correct host IP
- Save the host
- Repeat Steps 8 to 12 for every host that sends logs to NetEye 4 via Beats
- Deploy the Director configuration
- Go to the Log Manager module
- You should now see all the “beats-hosts” in the “Host” section
With this configuration, the scheduled job that signs and compresses the logs every night will now also take into consideration the files written by Logstash (coming from the Beats agents) that otherwise would be ignored. Furthermore, in the NetEye 4 Log Manager module “Log Check” section you will also find the status of the block chain of these logs.
Author
