Security Director FAQ

Log Collector Node Failure

Problem

Cause

You can only configure the IP address of a Log Collector node with the configuration script. If an IP address is configured manually, then the Log Collector node cannot be added to Security Director.

Solution

Verify that the following entry appears in the /etc/hosts file:<IP>LOG-COLLECTOR localhost.localdomain localhost. If you do not see this entry, then re-create the entry and add the node back through the Security Director administration workspace.

Unable to View Logs on the Monitor Page In Security Director

Problem

Cause

There could be a time mismatch between the Log Collector node and the Junos Space server.

Solution

The Log Collector and the Junos Space Network Management Platform must be synchronized with the NTP server. Use NTP to synchronize the time between nodes.

Adding a Log Collector Node

Problem

Cause

The node is added to another Junos Space server or the Junos Space server where it was added is no longer present.

Solution

You must delete the existing Log Collector node from Security Director > Administration > Logging Management > Logging Nodes before adding another Log Collector node.

1. Log in to the Log Collector node using root credentials and delete the following file: /etc/specialNodeAgent/nodeAdded-<IP>.
2. Add another Log Collector node to Security Director > Administration > Logging Management > Logging Nodes.

Monitoring Logs In Log Collector

Problem

Solution

System logs are retained until 80% of the disk space is utilized on the Log Collector node. Older logs are deleted to ensure that 20% of the disk space is free to store new logs.

Increasing the Disk Size of Log Collector

Problem

Solution

You can use the resizeFS.sh script to increase the disk size.

Unable to View System Logs Information

Problem

Cause

The system logs that are received might not be structured system logs.

Solution

You must ensure that only the structured system logs are sent to Log Collector, so that they are parsed and all the fields are displayed properly.

Status of Log Collector Node Is Down

Problem

Solution

The application status is shown as Down if the respective service is down. You must restart the service.

To restart each service:

For All-in-One node:

1. Log in to the node using root credentials.
2. Run the service logstash start command to start the Log Receiver service.
3. Run the service elasticsearch start command to start the Log Indexer service.

For Log Receiver node:

1. Log in to the node using root credentials.
2. Run the service logstash start command to start the Log Receiver service.

For Log Indexer node:

1. Log in to the node using root credentials.
2. Run the service elasticsearch start command to start the Log Indexer service.

Load Balance in Log Reception

Problem

Solution

To load balance log reception:

1. Select Security Director > Administration > Logging Management > Logging Devices.
2. Check the average log reception rate for each log receiver node.
3. Check the Device Configuration section to see the logs based on the device. You can find the rate at which each device sends its logs.
4. Reconfigure the devices so that the load is balanced between the two log receivers.

Unable to View Logging Infrastructure Information

Problem

Solution

You can use the diagnostics tool that scans through all of your Log Collector nodes. The tool gathers log files, configuration settings, and other health status information and then bundles all the information in a zip file. You can run this tool and generate the dump file.

To run the diagnostics tool:

1. Log in to the Log Indexer node (or All-in-One node) using root credentials.
2. Run the healthcheckOSLC script. The initial screening confirmation window appears.
   
3. Enter Yes to gather more information. A high level summary report appears.
   
4. Press Enter to generate the detailed report.
   

You can find the detailed dump file in /opt/system-diagnostics/out/<Date-Time> syslog-capture.pcap.