Configuring a Blue Coat SG Log Source

You can manually configure a Blue Coat SG log source in JSA.

1. Log in to JSA.
2. Click the Admin tab.
3. On the navigation menu, click Data Sources.
4. Click the Log Sources icon.
5. Click Add.
6. In the Log Source Name field, type a name for your log source.
7. From the Log Source Type list, select the Bluecoat SG Appliance option.
8. From the Protocol Configuration list, select the Log File option.
9. Configure the following values:

   Table 1: Blue Coat SG Log File Protocol Parameters

   Parameter	Description
   Log Source Identifier	Type an IP address, host name, or name to identify the event source. IP addresses or host names are recommended as they allow JSA to identify a log file to a unique event source.
   Service Type	From the list, select the protocol that you want to use when retrieving log files from a remote server. The default is SFTP. The underlying protocol that is used to retrieve log files for the SCP and SFTP service type requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.
   Remote IP or Hostname	Type the IP address or host name of the device that stores your event log files.
   Remote Port	Type the TCP port on the remote host that is running the selected Service Type. The valid range is 1 - 65535. The options include: FTP - TCP Port 21 SFTP - TCP Port 22 SCP - TCP Port 22 If the host for your event files is using a non-standard port number for FTP, SFTP, or SCP, you must adjust the port value.
   Remote User	Type the user name necessary to log in to the host that contains your event files. The user name can be up to 255 characters in length.
   Remote Password	Type the password necessary to log in to the host.
   Confirm Password	Confirm the password necessary to log in to the host.
   SSH Key File	If you select SCP or SFTP as the Service Type, this parameter gives you the option to define an SSH private key file. When you provide an SSH Key File, the Remote Password field is ignored.
   Remote Directory	Type the directory location on the remote host from which the files are retrieved, relative to the user account you are using to log in. For FTP only. If your log files are in the remote user's home directory, you can leave the remote directory blank. This is to support operating systems where a change in the working directory (CWD) command is restricted.
   Recursive	Select this check box if you want the file pattern to search sub folders in the remote directory. By default, the check box is clear. The Recursive option is ignored if you configure SCP as the Service Type.
   FTP File Pattern	If you select SFTP or FTP as the Service Type, this option gives you the option to configure the regular expression (regex) required to filter the list of files that are specified in the Remote Directory. All matching files are included in the processing. The FTP file pattern that you specify must match the name you assigned to your event files. For example, to collect files that end with .log, type the following: .*\.log Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/
   FTP Transfer Mode	This option appears only if you select FTP as the Service Type. The FTP Transfer Mode parameter gives you the option to define the file transfer mode when you retrieve log files over FTP. From the list, select the transfer mode that you want to apply to this log source: You must select NONE for the Processor parameter and LINEBYLINE the Event Generator parameter when you use ASCII as the FTP Transfer Mode.
   SCP Remote File	If you select SCP as the Service Type you must type the file name of the remote file.
   Start Time	Type the time of day you want the processing to begin. For example, type 00:00 to schedule the Log File protocol to collect event files at midnight. This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files. Type the start time, based on a 24 hour clock, in the following format: HH:MM.
   Recurrence	Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D). For example, type 2H if you want the remote directory to be scanned every 2 hours from the start time. The default is 1H.
   Run On Save	Select this check box if you want the log file protocol to run immediately after you click Save. After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule. Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File parameter.
   EPS Throttle	Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 to 5000.
   Processor	If the files located on the remote host are stored in a zip, gzip, tar, or tar+gzip archive format, select the processor that allows the archives to be expanded and contents processed.
   Ignore Previously Processed File(s)	Select this check box to track and ignore files that have already been processed by the log file protocol. JSA examines the log files in the remote directory to determine if a file has been previously processed by the log file protocol. If a previously processed file is detected, the log file protocol does not download the file for processing. All files that have not been previously processed are downloaded. This option only applies to FTP and SFTP Service Types.
   Change Local Directory?	Select this check box to define a local directory on your JSA system for storing downloaded files during processing. We recommend that you leave this check box clear. When this check box is selected, the Local Directory field is displayed, which allows you to configure the local directory to use for storing files.
   Event Generator	From the Event Generator list, select LineByLine. The Event Generator applies additional processing to the retrieved event files. Each line of the file is a single event. For example, if a file has 10 lines of text, 10 separate events are created.

10. Click Save.
11. On the Admin tab, click Deploy Changes.