STRM Log Manager Installation Guide

(1)

Juniper Networks, Inc.

1194 North Mathilda Avenue Sunnyvale, CA 94089 USA

408-745-2000

www.juniper.net

Security Threat Response Manager

STRM Log Manager Installation Guide

(2)

2 

Copyright Notice

Copyright © 2012 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

STRM Log Manage Installation Guide

Release 2012.0

September 2012—R2 STRM Installation Guide

(3)

C

ONTENTS

A

BOUT

T

HIS

G

UIDE

Documentation Conventions . . . 1

Technical Documentation . . . 1

Requesting Technical Support . . . 2

1 P

REPARING

F

OR

Y

OUR

I

NSTALLATION Deploying STRM Log Manager . . . 5

Additional Hardware Requirements . . . 7

Additional Software Requirements. . . 7

Browser Support . . . 8

Identifying Network Settings . . . 8

Preparing Your Network Hierarchy. . . 9

Identifying Security Monitoring Log Sources . . . 9

Preparing For HA . . . 11

2 I

NSTALLING

STRM L

OG

M

ANAGER

A

PPLIANCES Installing a STRM Log Manager Appliance . . . 13

Installing or Recovering a Secondary HA STRM Log Manager Appliance . . . 17

Recovering a Failed Primary HA STRM Log Manager Appliance . . . 20

Clearing the Cache . . . 24

Accessing STRM Log Manager . . . 25

A

I

NSTALLINGA

V

IRTUAL

A

PPLIANCE Before You Begin . . . 29

Preparing Your Virtual Machine for STRM Log Manager Installation. . . 30

Installing STRM Log Manager Software on Your Virtual Machine . . . 31

B

C

HANGING

N

ETWORK

S

ETTINGS Changing Network Settings in an All-in-One Console . . . 37

Changing the Network Settings of a Console in a Multi-System Deployment . . . 39

Changing the Network Settings of a Non-Console in a Multi-System Deployment . . 42

C

R

E

-

INSTALLING

STRM L

OG

M

ANAGER About the Recovery Partition . . . 47

Re-installing STRM Log Manager . . . 48

(4)

(5)

STRM Log Manager Installation Guide

A

BOUT

T

HIS

G

UIDE

The STRM Log Manager Installation Guide provides you with information on setting up STRM. STRM appliances are pre-installed with software and a CentOS operating system; however, you can install STRM software on your own hardware using Red Hat Enterprise Linux. This guide assumes a working knowledge of networking and Linux systems

Documentation

Conventions

The following conventions are used throughout this guide:Juniper customer support STRM Vulnerability Manager STRM Risk Manager

Indicates that the procedure contains a single instruction. NOTE

Indicates that the information provided is supplemental to the associated feature or instruction.

CAUTION

Indicates that the information is critical. A caution alerts you to potential loss of data or potential damage to an application, system, device, or network.

WARNING

Indicates that the information is critical. A warning alerts you to potential dangers, threats, or potential personal injury. Read any and all warnings carefully before proceeding.

Technical

Documentation

You can access technical documentation, technical notes, and release notes directly from the Juniper customer support website at www.juniper.net/support/. Once you access the Juniper customer support website, locate the product and

(6)

2 ABOUT THIS GUIDE

software release for which you require documentation.

Your comments are important to us. Please send your e-mail comments about this guide or any of the Juniper Networks documentation to:

[email protected].

Include the following information with your comments:

• Document title

• Page number

Requesting

Technical Support

Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at

http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf.

• Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/

• JTAC Hours of Operation —The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

• Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: http://www2.juniper.net/kb/

• Find product documentation: http://www.juniper.net/techpubs/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: https://www.juniper.net/alerts/

• Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

• Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

(7)

Requesting Technical Support 3

• Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

• For international or direct-dial options in countries without toll-free numbers, visit us at http://www.juniper.net/support/requesting-support.html.

(8)

(9)

1

P

REPARING

F

OR

Y

OUR

I

NSTALLATION

Your STRM Log Manager deployment can consist of STRM Log Manager installed on one or multiple systems. You can use the STRM Log Manager three-tier architecture to install components on a single server for small enterprises or distributed across multiple servers for maximum performance and scalability in large enterprise environments. STRM Log Manager also provides High Availability (HA) functionality, which requires you to install redundant appliances for each system you want to provide HA protection.

To ensure a successful STRM Log Manager deployment, adhere to the recommendations in this document.

This section provides information on the following:

• Deploying STRM Log Manager (page 5)

• Additional Hardware Requirements (page 7)

• Additional Software Requirements (page 7)

• Browser Support (page 8)

• Identifying Network Settings (page 8)

• Preparing Your Network Hierarchy (page 9)

• Identifying Security Monitoring Log Sources (page 9)

• Preparing For HA (page 11)

Deploying STRM

Log Manager

You can deploy STRM Log Manager using STRM Log Manager appliances or STRM Log Manager software installed on your own hardware.

• STRM Log Manager Components (page 6)

• Examples of STRM Log Manager Deployments (page 6)

A STRM Log Manager appliance includes STRM Log Manager software and a CentOS operating system. For further information about STRM Log Manager appliances, see the Hardware Installation Guide.

(10)

6 PREPARING FOR YOUR INSTALLATION

STRM Log Manager Components

STRM Log Manager components that can exist in your deployment include:

NOTE

For more information on each STRM Log Manager component, see the STRM

Log Manager Administration Guide.

• Console - Provides the user interface for STRM Log Manager. The Console

provides real time views and reports. Using the Console, you can also manage distributed STRM Log Manager deployments.

You access the Console from a standard web browser. When you access the system, a prompt is displayed for a username and password, which you configure during the installation process. You must also have Java installed on your desktop system. For information about software requirements, see

Additional Software Requirements (page 7).

• Event Collector - The Event Collector gathers events from local and remote

device sources. The Event Collector normalizes events, and then sends the information to the Event Processor. Before sending information to the Event Processor, the Event Collector bundles identical events to conserve system usage.

• Event Processor - Processes events collected from one or more Event

Collector. When received, the Event Processor correlates the information from STRM Log Manager and distributes the information to the appropriate area, depending on the type of event. The Event Processor also includes information gathered by STRM Log Manager to indicate behavioral changes or policy violations for the event. Rules are applied to the events that allow the Event Processor to process events according to the configured rules.

Examples of STRM Log Manager Deployments

The following figure shows an example of a small deployment using STRM Log Manager and STRM 5000 EP and 2500EP appliances.

STRM 5000 EP 2500 EP STRM Log Manager STRM 5000 EP 2500 EP

(11)

Additional Hardware Requirements 7

The following figure shows an example of a small HA deployment using STRM Log Manager and STRM 500 QFC appliances.

Additional

Hardware

Requirements

Before installing your STRM Log Manager systems, make sure you have access to the additional hardware components:

• Monitor and keyboard or a serial console

• Uninterrupted Power Supply (UPS)

CAUTION

All STRM Log Manager appliances are 64-bit. Make sure that you download the correct installation software for your OS.

NOTE

To make sure that your STRM Log Manager data is preserved during a power failure, we highly recommend that all STRM Log Manager appliances or systems running STRM Log Manager software that store data, such as Consoles and Event Processors, be equipped with a Uninterrupted Power Supply (UPS).

Additional Software

Requirements

Before installing STRM Log Manager, make sure you have the following applications installed on any desktop system you use to access the STRM Log Manager user interface:

• Java Runtime Environment installed on the desktop system you plan to use to view STRM Log Manager. You can download Java 1.6.0_u24 at the following website: http://java.com/.

• Adobe Flash 10.x installed on the your desktop used to access the STRM Log Manager Console. Secondary STRM 2500 Primary STRM 2500 Primary STRM 500 QFC Secondary STRM 500 QFC Primary STRM -QFC-BFC Secondary STRM-QFC-BFC

(12)

NOTE

Make sure that you install Java Runtime Environment on your desktop system, not the STRM Log Manager appliance.

Browser Support

You must have a browser installed on your desktop system to access the STRM Log Manager user interface. STRM Log Manager supports the following web browsers:

• Internet Explorer 8.0 and 9.0, with Compatibility View enabled - For

instructions on how to enable Compatibility View, see your browser documentation.

• Mozilla Firefox - Juniper Networks is committed to supporting the Mozilla

Firefox web browser. Due to Mozilla's short release cycles, it is not feasible to perform exhaustive compatibility testing on each Mozilla Firefox release. Juniper Networks has adopted a best effort strategy to support the Mozilla Firefox browser, in which compatibility issues are aggressively tracked and corrected as they are reported.

Identifying Network

Settings

Before you install STRM Log Manager, you must gather the following information for each system you want to install:

• Hostname

• IP address

• Network mask address

• Subnet mask

• Default gateway address

• Primary Domain Name System (DNS) server address

• Secondary DNS server (optional) address

• Public IP address for networks using Network Address Translation (NAT)

• Email server name

• Network Time Protocol (NTP) server (Console only) or time server name If you have already installed STRM Log Manager 2010.0r1 and are recovering a failed primary HA host, you must also gather the following information from the STRM Log Manager user interface:

• Cluster Virtual IP Address

• Primary IP Address NOTE

You can find these IP addresses in the System and License Management window by pointing your mouse over the row for the HA cluster. For more information, see the STRM Log Manager Administration Guide.

(13)

Preparing Your Network Hierarchy 9

Preparing Your

Network Hierarchy

STRM Log Manager uses the network hierarchy to understand your network traffic and provide you with the ability to view network activity for your entire deployment. STRM Log Manager supports any network hierarchy that can be defined by a range of IP addresses. You can create your network hierarchy based on many different variables, including geographical or business units. For example, your network hierarchy may include corporate IP address ranges (internal or external), physical departments or areas, mails servers, and web servers.

After you define the STRM Log Manager components you want to add to your network hierarchy and install STRM Log Manager, you can then configure the network hierarchy using the STRM Log Manager Console. For each STRM Log Manager component you want to add to your network hierarchy, use the following table as a job aid to record each network component (object) in your network map.

At a minimum, we recommend that you define objects in the network hierarchy for:

• Internal and external Demilitarized zones (DMZs)

• Virtual Private Networks (VPNs)

• All internal IP address space (for example, 10.0.0.0/8)

• Proxy servers

• (NAT) IP address range

• Server Network subnets

• Voice over IP (VoIP) subnets

For more information, see the STRM Log Manager Administration Guide - Setting

Up STRM Log Manager, Creating Your Network Hierarchy.

Identifying Security

Monitoring Log

Sources

STRM Log Manager collects and correlates events received from log sources,

which are external devices such as:

• Security equipment, such as firewalls, VPNs, and Intrusion Detection Systems (IDSs)

• Host or application security logs such as window logs

Device Support Modules (DSMs) allow you to integrate STRM Log Manager data from these log sources.

Table 1-1 Network Hierarchy

(14)

STRM Log Manager automatically discovers log sources that send syslog messages to an Event Collector. Automatically discovered log sources are

displayed in the Log Sources window within the Admin tab. For more information, see the STRM Log Manager Administration Guide.

You must add non-syslog based log sources to your deployment manually. For each non-syslog log source you want to add to your deployment, record log source information in the following table. For more information, see the Managing Log

Sources Guide.

Where:

• Log Source Type - Specifies the type of log source, such as firewall, router, or

VPN log sources.

• QTY - Specifies how many devices you have of each log source type.

• Product Name/Version - Specifies the log source product name and version

number.

• Link Speed & Type - Specifies the maximum network link speed (in Kbps) for

firewall, router, and VPN log sources. For the type, record the primary

application of the host system, for example, email, anti-virus, domain controller, or a workstation.

• Msg Level - Specifies the message level you want to log for this log source

type. For example, critical, informational, or debug.

• Avg Log Rate (Event/Sec) - Specifies the average event rate per second.

• No. of Users - Specifies the maximum number of hosts or users using or being

served by this log source.

• Network Location - Specifies whether this log source is located on the DMZ,

Internet, Intranet, or Extranet.

• Geographic Location - Specifies if the log sources are located on the same

LAN as STRM Log Manager or if they are sending logs over the Wide Area Network (WAN).

Table 1-2 Log Sources Log Source Type QTY Product Name/ Version Link Speed & Type Msg Level Avg Log Rate (Event/Sec) No. of Users Network Location Geographic Location Credibility (0 to 10)

(15)

Preparing For HA 11

• Credibility - Specifies the integrity of an event as determined by the credibility

rating from log sources. Credibility increases as multiple sources report the same event.

Preparing For HA

Before deploying HA in your environment, ensure your HA hosts adhere to the following requirements:

• The secondary host must have the same STRM Log Manager software version and patch level installed as the primary host in the HA cluster.

• The secondary host’s memory must be equal to or greater than the primary host’s memory.

• The secondary host must be located on the same subnet as the primary host.

• The secondary host’s /store partition must be larger than the /store partition on the primary host.

• If you plan to enable disk synchronization, we recommend that there is at least a 1 GB connection between the primary host and secondary host.

• If you plan for your HA hosts to share external storage, we recommend that there is at least a 1 GB connection between each HA host and your external storage solution.

(16)

(17)

2

I

NSTALLING

STRM L

OG

M

ANAGER

A

PPLIANCES

This section provides information on installing your STRM Log Manager appliance. A STRM Log Manager appliance includes STRM Log Manager software and a CentOS operating system. This section provides information for how to set up your appliance. For more information about appliances, see the Hardware Installation

Guide.

Choose which type of installation you want to perform:

• Installing a STRM Log Manager Appliance (page 13)

• Installing or Recovering a Secondary HA STRM Log Manager Appliance (page 17)

• Recovering a Failed Primary HA STRM Log Manager Appliance (page 20)

Installing a STRM

Log Manager

Appliance

To install a STRM Log Manager appliance:

Step 1 Prepare your appliance.

a Install all necessary hardware.

For information on your STRM Log Manager appliance, see the Hardware

Installation Guide.

b Choose one of the following options:

- Connect a laptop to the serial port on the rear of the appliance.

If you use a laptop to connect to the system, you must use a terminal program, such as HyperTerminal, to connect to the system. Make sure you set Connect

Using to the appropriate COM port of the serial connector and Bits per second

to 9600. You must also set Stop Bits (1), Data bits (8), and Parity (None). - Connect a keyboard and monitor to their respective ports.

For more information on appliance ports, see the Hardware Installation Guide.

c Power on the system and log in: Username: root

(18)

14 INSTALLING STRM LOG MANAGER APPLIANCES

NOTE

The username is case sensitive.

d Press Enter.

The End User License Agreement (EULA) is displayed.

e Read the information in the window. Press the Spacebar to advance each window until you have reached the end of the document.

Step 2 Choose your type of setup:

a Highlight normal, and then press the spacebar to select it.

b Press Enter to select Next. NOTE

To select an item on an installation window, press the Up and Down Arrow keys or press the Page Up and Page Down Keys to make a selection.

Step 3 Specify if you want to install a Console or non-Console system:

a Highlight one of the following options and press the spacebar to select that option:

• Yes - Select this option if this system is a Console.

• No - Select this option if this system is not a Console. NOTE

To select an option, highlight the option and press the spacebar to place an X in the parentheses.

NOTE

If you select Yes to indicate that your system is a Console, an error message is displayed if your system has less than 8 GB of RAM. We require that you upgrade the memory on your system before installing STRM Log Manager on your system.

b Press Enter to select Next.

The Tuning Template window is displayed.

Step 4 Select a tuning template:

a Select the Logger template.

Step 5 Highlight the method you want to use to set the date and time, and then press the spacebar to select that option:

• Manual - Select this option to manually input the time and date. Press the Tab

key to select the Next option and press Enter. The Current Date and Time window is displayed. Go to Step 6.

(19)

Installing a STRM Log Manager Appliance 15

• Server - Select this option to specify your time server. Press the Tab key to

select the Next option and press Enter. The Enter Time Server window is displayed. Go to Step 7.

Step 6 To manually enter the time and date:

a Type the current date and time.

b Press the Tab key to move to the Next option and press Enter.

c Go to Step 8.

Step 7 To specify a time server:

a In the text field, type the time server name or IP address.

b Press the Tab key to move to the Next option and press Enter. The Time Zone Continent window is displayed.

Step 8 Select your time zone continent area.

Step 9 Press Enter to select Next.

The Time Zone Region window is displayed. NOTE

The options displayed in this window are regions that are associated with the continent or area previously selected.

Step 10 Select your time zone region.

Step 12 Choose which internet protocol version to use:

a Highlight the internet protocol version you want to use, and press the spacebar to select it:

- IPv4 - IPv6

b Press Enter to select Next and specify your management interface.

The window displays up to a maximum of four interfaces depending on your hardware configuration. Each interface with a physical link is denoted with a (+) symbol.

Step 13 Highlight the interface you want to specify as the management interface and press the spacebar to select it.

Step 15 Choose one of the following options:

• If you are using IPv4 as your Internet protocol, go to Step 18.

• If you are using IPv6 as your Internet protocol, go to Step 16.

a To automatically configure for IPv6, select Yes and press Enter. The automatic configuration can take an extended period of time. Go to Step 18.

(20)

b To manually configure for IPv6, select No and press Enter. Go to Step 17.

Step 17 To enter network information to use for IPv6:

a Type the values for the Hostname and Email server.

Step 18 Configure the STRM Log Manager network settings:

a Enter values for the following parameters:

• Hostname - Type a fully qualified domain name as the system hostname.

• IP Address - Type the IP address of the system.

• Network Mask - Type the network mask address for the system.

• Gateway - Type the default gateway of the system.

• Primary DNS - Type the primary DNS server address.

• Secondary DNS - Optional. Type the secondary DNS server address.

• Public IP - Optional. Type the Public IP address of the server. This is a

secondary IP address that is used to access the server, usually from a different network or the Internet, and is managed by your network administrator. The Public IP address is often configured using Network Address Translation (NAT) services on your network or firewall settings on your network. NAT translates an IP address in one network to a different IP address in another network.

• Email Server - Type the name of the email server. If you do not have an email

server, type localhost in this field.

b Press the Tab key to move to the Next option and press Enter. NOTE

If you are changing network settings using the qchange_netsetup utility, press the Tab key to move to the Finish option and press Enter. See Changing Network Settings (page 37).

Step 19 Configure the STRM Log Manager root password:

a Type your password.

b Press the Tab key to move to the Next option and press Enter. The Confirm New Root Password window is displayed.

c Retype your new password to confirm.

d Press the Tab key to move to the Finish option and press Enter.

A series of messages are displayed as STRM Log Manager continues with the installation. This process typically takes several minutes.

The Configuration is Complete window is displayed.

e Press Enter to select OK.

You are now ready to access STRM Log Manager. For more information on accessing STRM Log Manager, see Accessing STRM Log Manager (page 25).

(21)

Installing or Recovering a Secondary HA STRM Log Manager Appliance 17

Installing or

Recovering a

Secondary HA

STRM Log Manager

Appliance

Before deploying HA in your environment, ensure your HA hosts adhere to the following requirements:

• The secondary host must have the same STRM Log Manager software version installed as the primary host in the HA cluster.

• The secondary host’s memory must be equal to or greater than the primary host’s memory.

• The secondary host must be located on the same subnet as the primary host.

• The secondary host’s /store partition must be larger than the /store partition on the primary host.

• If you plan to enable disk synchronization, we recommend that there is at least a 1 GB connection between the primary host and secondary host.

• If you plan for your HA hosts to share external storage, we recommend that there is at least a 1 GB connection between each HA host and your external storage solution.

To install or recover your secondary HA appliance for STRM Log Manager appliance:

- Connect a laptop to the serial port on the rear of the appliance.

c Power on the system and log in: Username: root

NOTE

d Press Enter.

(22)

Step 2 Specify your secondary device type:

a Choose one of the following options:

• If you are installing a secondary device for a Console, highlight This system is

a stand-by for a console, and then press the spacebar to select the option.

• If you are not installing a secondary device for a Console, highlight This

system is a stand-by for a non-console, and then press the spacebar to

select the option.

c Go to Step 10.

Step 6 Select your time zone continent or area.

The options displayed in this window are regions that are associated with the continent or area previously selected.

Step 10 Choose which internet protocol version to use:

(23)

Installing or Recovering a Secondary HA STRM Log Manager Appliance 19

NOTE

IPv6 is not supported in an HA environment. If you are installing software or an appliance and you select the IPv6 option, an error message is displayed. In this case, select Back and then select IPv4. You can then proceed to next step in your installation.

Step 13 To configure the STRM Log Manager network settings:

NOTE

If you are recovering an HA appliance, the IP address is the Primary HA IP address, which you can identify in the System and License Management window by pointing your mouse over the row for the HA cluster. For more information on managing HA, see the STRM Log Manager Administration Guide - Managing

High Availability.

• Email Server - Type the name of your email server. If you do not have an email

If you are changing network settings using qchange_netsetup, press the Tab key to move to the Finish option and press Enter. See Changing Network Settings (page 37).

(24)

Step 14 To configure the STRM Log Manager root password:

Step 15 Log in to the STRM Log Manager user interface. See Accessing STRM Log Manager (page 25).

Step 16 Configure your HA cluster. For more information on configuring your HA cluster, see the STRM Log Manager Administration Guide - Managing High Availability.

Recovering a Failed

Primary HA STRM

Log Manager

Appliance

Before you recover a failed primary HA appliance, you must gather the following information from the STRM Log Manager user interface:

• Cluster Virtual IP Address

• Primary IP Address NOTE

You can find these IP addresses in the System and License Management window by pointing your mouse over the row for the HA cluster. For more information, see the STRM Log Manager Administration Guide - Managing High Availability.

CAUTION

If your HA cluster uses shared storage, you must manually configure iSCSI. For more information about configuring iSCSI, see the Configuring iSCSI technical note.

To recover a failed primary HA appliance:

(25)

Recovering a Failed Primary HA STRM Log Manager Appliance 21

c Power on the system and log in: Login: root

NOTE

d Press Enter.

Step 2 Specify your secondary device type:

a Choose one of the following options:

• If you are installing a secondary device for a Console, using the up/down arrow keys, highlight This system is a stand-by for a console, and then press the spacebar to select the option.

• If you are not installing a secondary device for a Console, using the up/down arrow keys, highlight This system is a stand-by for a non-console, and then press the spacebar to select the option.

Step 3 Set the time and date.

NOTE

(26)

c Go to Step 11.

The options that are displayed in this window are regions that are associated with the continent or area previously selected.

Step 11 Choose which internet protocol version to use.

a Select IPv4

NOTE

IPv6 is not supported in an HA environment. If you are installing software or an appliance and you select the IPv6 option, an error message is displayed. In this case, select Back and then select IPv4. You can then proceed to next step in your installation.

Step 14 To configure your Cluster Virtual IP address:

a Type the Cluster Virtual IP address.

The Cluster Virtual IP address is the original IP address of the primary HA system. You can find this IP address in the System and License Management window by pointing your mouse over the row for the HA cluster.

Step 15 To configure the STRM Log Manager network settings:

(27)

Recovering a Failed Primary HA STRM Log Manager Appliance 23

NOTE

If you are recovering an HA appliance, the IP address is the Primary HA IP address, which you can identify in the System and License Management window by pointing your mouse over the row for the HA cluster. For more information on managing HA, see the STRM Log Manager Administration Guide - Managing

High Availability.

If you are changing network settings using qchange_netsetup, press the Tab key to move to the Finish option and press Enter. See Changing Network Settings (page 37).

Step 16 To configure the STRM Log Manager root password:

Step 17 Log in to the STRM Log Manager user interface. See Accessing STRM Log Manager (page 25).

Step 18 Restore the failed primary HA system. For more information on restoring a failed primary HA system, see the STRM Log Manager Administration Guide - Managing

(28)

Clearing the Cache

If you have trouble accessing the STRM Log Manager user interface after you install STRM Log Manager 2010.r1, we recommend that you clear your Java and web browser cache.

To clear your cache and access the STRM Log Manager user interface: NOTE

Make sure that you have Java Runtime Environment installed on your desktop system. You can download Java 1.6.0_u20 at the following website:

http://java.com/.

Step 1 Clear your Java cache:

a On your desktop, select Start > Control Panel. The Control Panel is displayed.

b Double-click the Java icon.

The Java Control Panel is displayed. NOTE

If you are using Microsoft Windows 7 as your operating system, the Java icon may be located under the Programs pane, depending on how your Control Panel is configured to display features.

c In the Temporary Internet Files pane, click View. The Java Cache Viewer is displayed.

d Select all STRM Log Manager Deployment Editor entries.

e Click the Delete icon.

f Click Close.

Step 2 Open your web browser.

Step 3 Clear the cache of your web browser: NOTE

Before you clear the cache, make sure you have only one instance of your browser open. If you have multiple versions of your browser open, the cache fails to clear.

a If you are using Internet Explorer 7.0 or 8.0, select Tools > Delete Browsing

History.

b If you are using Internet Explorer 9.0, click the gear icon in right corner of the browser window, select Internet Options > General, and then click Delete in the Browsing History pane.

c If you are using Mozilla Firefox 3.6.x and above, select Tools > Clear Recent

(29)

Accessing STRM Log Manager 25

NOTE

If you are using Mozilla Firefox, you must clear the cache in Internet Explorer as well as in Mozilla Firefox.

Step 4 Log in to STRM Log Manager.

For more information on accessing and using STRM Log Manager, see the STRM

Log Manager Users Guide or STRM Log Manager Administration Guide.

A

ccessing STRM

Log Manager

To access the STRM Log Manager user interface:

Step 1 Open your web browser.

Step 2 Log in to STRM Log Manager:

https://<IP Address>

Where <IP Address> is the IP address of the STRM Log Manager system. The

default values are: Username: admin

Password: <root password>

Where <root password> is the password assigned to STRM Log Manager during the installation process.

NOTE

If you are using Mozilla Firefox, you must add an exception to Mozilla Firefox to log in to STRM Log Manager. For more information, see your Mozilla

documentation. NOTE

If you are using Internet Explorer, a website security certificate message is displayed. You must select the Continue to this website option to log in to STRM Log Manager.

Step 3 Click Login To STRM Log Manager.

For your STRM Log Manager Console, a default license key provides you access to STRM Log Manager for five weeks. For more information on the license key, see the STRM Log Manager Administration Guide.

(30)

(31)

A

I

NSTALLING

A

V

IRTUAL

A

PPLIANCE

A virtual appliance enables the same visibility and functionality in your virtual network infrastructure that the STRM Log Manager appliance offers in your physical environment.

The STRM Log Manager 8099 virtual appliance is a STRM Log Manager system manages and stores events from various network devices. The STRM Log Manager 8099 virtual appliance includes an on-board Event Collector, Event Processor, and internal storage for events.The STRM Log Manager 8099 virtual appliance supports:

• 1,000 Events Per Second (EPS), depending on your license

• 2 TB or larger dedicated event storage

• Before You Begin

• Preparing Your Virtual Machine for STRM Log Manager Installation

• Installing STRM Log Manager Software on Your Virtual Machine

After you install your virtual appliances, you can access the deployment editor and add your virtual appliances to your deployment. For more information on

connecting appliances using the deployment editor, see the STRM Log Manager

Administration Guide.

Before You Begin

Before you install your virtual appliance, note the following:

• Virtual appliances require VMware ESXi 4.1. You must have a VMware client installed on your desktop. VMware server applications are bundled with client software. For example, ESXi 4.1 is bundled with VMware vSphere client 4.1. If your server/client configuration differs, we recommend you upgrade your VMware server and client. For more information, see http://www.vmware.com.

• 8 GB of free memory is required by the VMware host for STRM Log Manager 8099. 12 GB is optimal.

(32)

30

Preparing Your

Virtual Machine for

STRM Log Manager

Installation

• Creating your Virtual Machine

• Installing the STRM Log Manager ISO on the Virtual Machine

Creating your Virtual Machine

To create your virtual machine:

Step 1 Access your vSphere Client.

Step 2 Select File > New > Virtual Machine.

The Create New Virtual Machine window is displayed.

Step 3 In the Configuration pane, select the Custom option and click Next.

Step 4 In the Name field, type a unique name for the virtual machine and click Next.

Step 5 In the right pane, select the datastore where you want to store the virtual machine and click Next.

Step 6 In the Virtual Machine Version pane, select the Virtual Machine Version: 7 option and click Next.

Step 7 Select the guest Operating System (OS) for the STRM Log Manager virtual appliance:

a In the Guest Operating System pane, select the Linux option.

b From the Version list box, select Red Hat Enterprise Linux 5 (64-bit) and click

Next.

Step 8 From the Number of virtual processors list box, select the number of processors you want for the virtual machine and click Next. You must select a minimum of 2 processors.

Step 9 In the Memory Configuration pane, provide a minimum of 8 GB for memory:

a In the Memory Size field, type or select 8 or higher.

b In the list box, select GB.

Step 10 Configure your network connections:

a From the How many NICs do you want to connect list box, select the number of Network Interface Controllers (NICs) you want to add. You must add at least one NIC.

b For all NICs, select VMXNET3 from the Adapter list box.

c Click Next.

Step 11 In the SCSI Controller pane, select VMware Paravirtual and click Next.

Step 12 In the Disk pane, select Create a new virtual disk.

Step 13 Configure the virtual disk size and select a provisioning policy:

a In the Capacity pane, type or select 36 or higher and select GB from the list box.

(33)

Installing STRM Log Manager Software on Your Virtual Machine 31

b In the Disk Provisioning pane, select the Allocate and commit space on

demand (Thin provisioning) check box.

c Click Next.

The Advanced Options page is displayed. Do not configure the options on this page.

Step 14 Click Next.

The Ready to Complete page is displayed. Review the settings for your new virtual machine and edit the settings if required.

Step 15 Click Finish.

Your virtual machine is ready for optimal performance when running your STRM Log Manager virtual appliance.

Installing the STRM Log Manager ISO on the Virtual Machine

To install STRM Log Manager software on a virtual appliance:

Step 1 Obtain the STRM Log Manager software from the Juniper customer support website.

Step 2 In the left pane of your VMware vSphere Client, select your virtual machine from the menu tree.

Step 3 In the right pane, click the Summary tab.

Step 4 In the Commands pane, click Edit Settings.

The Virtual Machine Properties window is displayed.

Step 5 In the left pane, click CD/DVD Drive 1.

Step 6 In the Device Status pane, select the Connect at power on check box.

Step 7 In the Device Type pane, select Datastore ISO File and click Browse. The Browse Datastores window is displayed.

Step 8 Locate and select the ISO file and click Open.

Step 9 Click OK.

The virtual machine is now ready to power up and install STRM Log Manager. For more information, see Installing STRM Log Manager Software on Your Virtual Machine.

Installing STRM

Log Manager

Software on Your

Virtual Machine

To install STRM Log Manager software on your virtual machine:

Step 1 Access your vSphere Client.

(34)

32

Step 3 Log in to the virtual machine: Username: root

NOTE

Step 4 Press Enter.

Step 5 Read the information in the window. Press the Spacebar to advance each window until you have reached the end of the document.

Step 6 Choose your type of setup:

a Highlight normal, and then press the Spacebar to select it.

Step 7 Specify if you want to install a Console or non-Console system.

• Yes - Select this option if this system is a Console.

• No - Select this option if this system is not a Console.

To select your chosen option, make sure you highlight the option and press the Spacebar to place an X in the parentheses.

NOTE

If you select Yes to indicate that your system is a Console, an error message is displayed if your system has less than 8 GB of RAM. We require that you upgrade the memory on your system before installing STRM Log Manager on your system.

c Press Enter to select Next.

Step 8 Select a tuning template:

a Select the Enterprise template.

Step 9 Highlight the method you want to use to set the date and time, and then press the Spacebar to select that option:

key to select the Next option and press Enter. The Current Date and Time window is displayed. Go to Step 10.

select the Next option and press Enter. The Enter Time Server window is displayed. Go to Step 11.

(35)

Installing STRM Log Manager Software on Your Virtual Machine 33

c Go to Step 12.

The options that are displayed in this window are regions that are associated with the continent or area you previously selected.

a Select one of the following options: - IPv4

- IPv6

b Press Enter to select Next to specify your management interface.

Step 17 Highlight the interface you want to specify as the management interface and press the Spacebar to select it.

• If you are using IPv4 as your Internet protocol, go to Step 22.

• If you are using IPv6 as your Internet protocol, go to Step 20.

a To automatically configure for IPv6, select Yes and press Enter. The automatic configuration can take an extended period of time. Go to Step 22.

b To manually configure for IPv6, select No and press Enter. Go to Step 21.

(36)

34

Step 22 Configure the STRM Log Manager network settings:

• Email Server - Type the email server. If you do not have an email server, type

localhost in this field.

If you are changing network settings using the qchange_netsetup utility, press the Tab key to move to the Finish option and press Enter. See Changing Network Settings.

Step 23 Configure the STRM Log Manager root password:

(37)

(38)

B

C

HANGING

N

ETWORK

S

ETTINGS

This appendix provides information on changing network settings for the Console and non-Console systems, including:

• Changing Network Settings in an All-in-One Console (page 37)

• Changing the Network Settings of a Console in a Multi-System Deployment (page 39)

• Changing the Network Settings of a Non-Console in a Multi-System Deployment (page 42)

CAUTION

Changing the network settings of a host in an HA cluster causes HA to cease functioning on the cluster. If you want to change the network settings of a host in an HA cluster, you must first remove the host from the cluster, make your

changes, and then re-add the host to the cluster.

Changing Network

Settings in an

All-in-One Console

You can change the network settings in your All-In-One system. An All-In-One system has all STRM Log Manager components, including the Admin tab, installed on one system.

To change the settings on the STRM Log Manager Console: NOTE

You must have a local connection to your Console before executing the script.

Step 1 Using SSH, log in to STRM as the root user. Username: root

Password: <password>

Step 2 Type the following command:

qchange_netsetup

a Highlight the internet protocol version you want to use and press the spacebar to select it:

(39)

38

- IPv4 - IPv6

b Press Enter to select Next and specify your management interface NOTE

• If you are using IPv4 as your Internet protocol, see Step 9.

• If you are using IPv6 as your Internet protocol, see Step 7.

a To automatically configure for IPv6, select Yes and press Enter. The automatic configuration can take an extended period of time. Go to Step 9.

b To manually configure for IPv6, select No and press Enter. Go to Step 8.

Step 9 Configure the STRM network settings:

(40)

Changing the Network Settings of a Console in a Multi-System Deployment 39

Step 10 Press the Tab key to navigate to the Finish option. Press Enter.

A series of messages are displayed as STRM Log Manager processes the requested changes. After the requested changes are processed, the STRM Log Manager system is automatically shutdown and rebooted.

Changing the

Network Settings of

a Console in a

Multi-System

Deployment

To change the network settings in a multi-system deployment, you must remove all non-Console managed hosts from the deployment, change the network settings, re-add the managed hosts, and then re-assign the components.

You must perform this procedure in the following order:

1 Removing Non-Console Managed Hosts (page 39)

2 Changing the Network Settings (page 40)

3 Re-Adding Managed Hosts and Re-Assigning the Components (page 41) NOTE

This procedure requires you to use the deployment editor. For more information on using the deployment editor, see the STRM Log Manager Administration

Guide.

Removing Non-Console Managed Hosts

To remove non-Console managed hosts from your deployment, you must:

Step 1 Log in to STRM Log Manager:

https://<IP Address>

Where <IP Address> is the IP address of the STRM Log Manager system.

Username: admin

Password: <admin password>

Step 2 On the STRM Log Manager user interface, click the Admin tab.

Step 3 Click the Deployment Editor icon. The deployment editor is displayed.

Step 4 Click the System View tab.

Step 5 Right-click the managed host you want to delete and select Remove host. Repeat for each non-Console managed host until all hosts are deleted.

Step 6 Click Save.