You will need to configure the USM Appliance Logger if you are deploying one of the following:

• USM Appliance Standard or Enterprise solution
• Using USM Appliance All-in-One, but deploying one or more additional USM Appliance Loggers to the one that comes with the All-in-One

Unlike the Standard/Enterprise USM Appliance Server and Sensors, the USM Appliance Logger can only be configured through the USM Appliance web UI.

Prerequisites

• You must have already deployed the USM Appliance Server and USM Appliance Logger, and completed the initial setup tasks.
• If using USM Appliance version 5.5.1 or later, you must set a remote key on the USM Appliance Server for the USM Appliance Logger to authenticate the system. To set the key, go to Configuration > Administration > Main > Login Methods/Options > Remote login key. While there is no constraint on the key, AlienVault recommends that you use something difficult to break, such as a GUID (Globally Unique Identifier).
• If you intend to configure VPN in your USM Appliance deployment, you must set up the VPN tunnel beforehand. This provides you with a VPN IP address that you use in this configuration task. For details, see VPN Configuration.
• If you do not plan to use a VPN, be aware that USM Appliance Logger receives events through TCP/40001. Make sure traffic can go through that port on your network.

Add USM Appliance Server to USM Appliance Logger

After deploying the USM Appliance Logger and finishing the initial setup tasks, you need to establish the connection between the USM Appliance Logger and the USM Appliance Server or the USM Appliance All-in-One.

To add the USM Appliance Server to the USM Appliance Logger

1. Log into the USM Appliance Logger web UI.

2. Go to Configuration > Deployment > Servers and click Add Server.

   

3. Type the IP address and root password of the USM Appliance Server; click Save.

   Important: If this USM Appliance deployment uses VPN, substitute the VPN IP for the physical IP address.

4. Return to the Servers screen, and select the USM Appliance Logger; click Modify.
5. On the next page, click No for all the options on the form except Log; click Yes there.

6. Click Save.

   

Configure Log Forwarding

Next, you need to configure log forwarding on the USM Appliance Server or USM Appliance All-in-One.

To configure log forwarding

1. Log into the USM Appliance Server web UI.

2. Go to Configuration > Deployment > Servers.

   You should now see both the USM Appliance Server and the USM Appliance Logger listed.

3. Select the USM Appliance Logger and click Modify.

4. On the next page, type the credentials for the Remote Admin User and the Remote Password.

   These are the admin user credentials to log into the Logger.

5. To populate the remote URL field automatically, click anywhere within the field.

6. Click Set Remote Key.

   Warning: Starting from version 5.5.1, the remote key cannot be empty. You need to use the same key on every USM Appliance Server connecting to the USM Appliance Logger. A warning displays if the key is not set. See Prerequisites for more details.

7. Return to the Servers page, select the USM Appliance Server and click Modify.
8. Set the option for Log to No.

9. In the Forward Servers section of the page, click Add Server.

   This extends the form and displays a list labeled Server.

10. Select the USM Appliance Logger and click Add New.

    The Logger and its IP address appears in the Server field.

11. Click Save.
12. Return to the Servers page, click Apply Changes.

13. To verify that you added the USM Appliance Logger successfully, click Server Hierarchy.

    You should now see that there is an arrow extending from the USM Appliance Server to the USM Appliance Logger, where previously they were each floating freely in the graph.

    

The Logger becomes active immediately. To view logger activity on the USM Appliance Server or USM Appliance All-in-One, go to Analysis > Raw Logs.

Note: The Server column displays the name of the USM Appliance Logger, indicating these events are not stored locally.

Checking System Status of the USM Appliance Logger

After the USM Appliance Logger starts receiving raw logs, it will fill up if left unattended. Therefore, AlienVault recommends that you check the system status of the USM Appliance Logger frequently. To determine how many events your USM Appliance Logger stores every day and how often you should check, refer to Establishing Baseline Network Behavior.

To check system details of the USM Appliance Logger

1. Log into the USM Appliance Logger using the web UI.
2. Go to Configuration > Deployment > AlienVault Center.

3. Double click the logger for which you want to check the status.

   The System Details page of the logger displays, where you can find disk usage, as well as RAM, Swap, and CPU usage:

   

In addition to checking the System Details page, USM Appliance issues a warning when the system has less than 25% or 10% of the total disk space available. You can find these warnings in the Message Center Inbox in the USM Appliance web UI which lists messages publicizing availability of various AlienVault product updates plus other messages such as system errors and warnings. on the USM Appliance Logger.