Alert Logic Log Manager for Rackspace Public Cloud (Linux agent)

Before you begin:

Download the agent

To download the agent:

  1. In the Alert Logic console, open the Settings menu, and then click Support Information.
  2. From the menu bar, click Quick Install Guide and Downloads.
  3. Download the appropriate agent and follow the on-screen instructions.
    • For Windows users, click Windows Agents, and then select the desired agent.
    • For Linux users, click Linux Agents. Linux users can select either Debian-based agent installers or RPM-based agent installers. Both installers are available in a 32-bit or 64-bit format.
  4. Locate the Unique Registration Key from the Downloads screen. Copy your unique registration key. You will need to enter this key to install the agent.

If you have an active RBAC role, and have configured agents to automatically update, the agent you install automatically assigns itself to the local appliance and you need not enter the Unique Registration Key.

Alert Logic uses the Unique Registration Key to assign the agent to your Alert Logic account.

Install the agent for Linux

If you have previously installed a Linux version of the Alert Logic agent, you must uninstall that version before you install the current Alert Logic agent image.

Install the agent

To install the agent:

This method does not support image capture.

  1. Copy the package to the target machine.
  2. If you run SELinux, you must first run the following command:
    semanage port -a -t syslogd_port_t -p tcp 1514

If the semanage command is not present in your system, you can install the policycoreutils-python package to obtain the semanage command. Alert Logic recommends that you consult with your system administrator to verify.

  1. Run one of the following commands, based on your distribution:
    • RPM: rpm -U al-agent-<version>*.rpm
    • Debian: dpkg –i al-agent-<version>*.deb
  2. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify this as a single point of egress for agents to use, run the following command:
    /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>
  3. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>

    A TCP or HTTP proxy may be used in this configuration.

  4. Run the following command: /etc/init.d/al-agent configure --key <UNIQUEREGISTRATIONKEY>

If you have an active RBAC role, and have configured agents to automatically update, the agent you install automatically assigns itself to the local appliance and you need not enter the Unique Registration Key.

  1. (Optional) If you use an rsyslog daemon, add the following line to rsyslog.conf:
    *.* @@127.0.0.1:1514;RSYSLOG_FileFormat

This configuration directs your local syslog to the agent on TCP port 1514.

  1. (Optional) If you use a syslog-ng daemon, add the following lines to syslog-ng.conf:
    • destination d_alertlogic {tcp("localhost" port(1514));};
    • log { source(s_src); destination(d_alertlogic); };

This configuration directs your local syslog to the agent on TCP port 1514.

  1. Restart the syslog daemon.
  2. Verify that the agent has registered with the Alert Logic console. To do so, navigate to the deployment the agent is assigned to, click Hosts and Sources, click Sources, and then search for the agent.

Agent registration can take several minutes.

Install the agent with image capture

To install the agent and capture the image:

  1. Copy the package to the target machine.
  2. If you run SELinux, you must first run the following command:
    semanage port -a -t syslogd_port_t -p tcp 1514

If the semanage command is not present in your system, you can install the policycoreutils-python package to obtain the semanage command. Alert Logic recommends that you consult with your system administrator to verify.

  1. Run one of the following commands, based on your distribution:
    • RPM : rpm -U al-agent-<version>*.rpm
    • Debian: dpkg –i al-agent-<version>*.deb
  1. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify this as a single point of egress for agents to use, run the following command:
    /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>
  2. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>

    A TCP or HTTP proxy may be used in this configuration.

  3. Run the following command: /etc/init.d/al-agent provision --key <UNIQUEREGISTRATIONKEY> --inst-type host
  4. Run the following command: /etc/init.d/al-agent start
  5. (Optional) If you use an rsyslog daemon, add the following line to rsyslog.conf:
    *.* @@127.0.0.1:1514;RSYSLOG_FileFormat

This configuration directs your local syslog to the agent on TCP port 1514.

  1. (Optional) If you use a syslog-ng daemon, add the following lines to syslog-ng.conf:
    1. destination d_alertlogic {tcp("localhost" port(1514));};
    2. log { source(s_src); destination(d_alertlogic); };

This configuration directs your local syslog to the agent on TCP port 1514.

  1. Restart the syslog daemon.
  2. Verify that the agent has registered with the Alert Logic console.To do so, clickDeployments, click the deployment the agent is assigned to, clickHosts and Sources, click Sources, and then search for the agent.

Agent registration can take several minutes.

Create a collection alert rule

You can create a collection alert in Alert Logic Log Manager to receive notification if collection stops for any reason.

You must first create a collection alert and then apply the alert to the source.

To create a collection alert:

  1. At the top of the Alert Logic console, from the drop-down menu, select Log Manager.
  2. In the left navigation, under Alert Rules, click Collection.
  3. In the table of alert rules, in the Actions column, click the gear icon (), and select New Collection Alert.
  4. In Collection Alert Name, type a descriptive name.
  5. In Time without logs, type a number value in minutes.
  6. In Time Between Alert Occurrences, type a number value in minutes.

You cannot specify a number value of more than 3,600.

  1. In Email Addresses, type an email address. To add multiple email addresses, separate each entry with a comma.
  1. Select Send Alert Once to receive alerts only once.
  2. Click Save

Apply a collection alert rule

To apply the collection alert to a log source:

  1. In the left navigation, under Collection, click Sources.
  2. In Select Some Options, click the empty and select a log source type and then click Apply Filters.
  3. In the table of log sources, in the Actions column, click the gear icon ().
  4. Select Mass Edit.
  5.  In Apply changes to, select All Sources.
    • Select Only Selected Sources to choose an individual log source from the table.
  6.  Select your collection alert in Collection Policy.
  1. Click Apply.

Related topics