Alert Logic Log Manager for Rackspace Public Cloud (Linux agent)

Download the agent

To download the agent:

1. In the Alert Logic console, open the Settings menu, and then click Support Information.
2. From the menu bar, click Quick Install Guide and Downloads.
3. Download the appropriate agent and follow the on-screen instructions.
   • For Windows users, click Windows Agents, and then select the desired agent.
   • For Linux users, click Linux Agents. Linux users can select either Debian-based agent installers or RPM-based agent installers. Both installers are available in a 32-bit or 64-bit format.
     
4. Locate the Unique Registration Key from the Downloads screen. Copy your unique registration key. You will need to enter this key to install the agent.
   

Install the agent for Linux

Install the agent

To install the agent:

1. Copy the package to the target machine.
2. If you run SELinux, you must first run the following command:
   semanage port -a -t syslogd_port_t -p tcp 1514

3. Run one of the following commands, based on your distribution:
   • RPM: rpm -U al-agent-<version>*.rpm
   • Debian: dpkg –i al-agent-<version>*.deb
4. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify this as a single point of egress for agents to use, run the following command:
   /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>
5. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>

   A TCP or HTTP proxy may be used in this configuration.

6. Run the following command: /etc/init.d/al-agent configure --key <UNIQUEREGISTRATIONKEY>

7. (Optional) If you use an rsyslog daemon, add the following line to rsyslog.conf:
   *.* @@127.0.0.1:1514;RSYSLOG_FileFormat

8. (Optional) If you use a syslog-ng daemon, add the following lines to syslog-ng.conf:
   • destination d_alertlogic {tcp("localhost" port(1514));};
   • log { source(s_src); destination(d_alertlogic); };

9. Restart the syslog daemon.

10. Verify that the agent has registered with the Alert Logic console. To do so, navigate to the deployment the agent is assigned to, click Hosts and Sources, click Sources, and then search for the agent.

Install the agent with image capture

To install the agent and capture the image:

1. Copy the package to the target machine.
2. If you run SELinux, you must first run the following command:
   semanage port -a -t syslogd_port_t -p tcp 1514

3. Run one of the following commands, based on your distribution:
   • RPM : rpm -U al-agent-<version>*.rpm
   • Debian: dpkg –i al-agent-<version>*.deb

4. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify this as a single point of egress for agents to use, run the following command:
   /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>
5. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>

   A TCP or HTTP proxy may be used in this configuration.

6. Run the following command: /etc/init.d/al-agent provision --key <UNIQUEREGISTRATIONKEY> --inst-type host
7. Run the following command: /etc/init.d/al-agent start
8. (Optional) If you use an rsyslog daemon, add the following line to rsyslog.conf:
   *.* @@127.0.0.1:1514;RSYSLOG_FileFormat

9. (Optional) If you use a syslog-ng daemon, add the following lines to syslog-ng.conf:
   1. destination d_alertlogic {tcp("localhost" port(1514));};
   2. log { source(s_src); destination(d_alertlogic); };

10. Restart the syslog daemon.
11. Verify that the agent has registered with the Alert Logic console.To do so, clickDeployments, click the deployment the agent is assigned to, clickHosts and Sources, click Sources, and then search for the agent.

Create a collection alert rule

You can create a collection alert in Alert Logic Log Manager to receive notification if collection stops for any reason.

You must first create a collection alert and then apply the alert to the source.

To create a collection alert:

1. At the top of the Alert Logic console, from the drop-down menu, select Log Manager.
2. In the left navigation, under Alert Rules, click Collection.
3. In the table of alert rules, in the Actions column, click the gear icon (), and select New Collection Alert.
4. In Collection Alert Name, type a descriptive name.
5. In Time without logs, type a number value in minutes.
6. In Time Between Alert Occurrences, type a number value in minutes.

7. In Email Addresses, type an email address. To add multiple email addresses, separate each entry with a comma.

8. Select Send Alert Once to receive alerts only once.
9. Click Save

Apply a collection alert rule

To apply the collection alert to a log source:

1. In the left navigation, under Collection, click Sources.
2. In Select Some Options, click the empty and select a log source type and then click Apply Filters.
3. In the table of log sources, in the Actions column, click the gear icon ().
4. Select Mass Edit.
5.  In Apply changes to, select All Sources.
   • Select Only Selected Sources to choose an individual log source from the table.
6.  Select your collection alert in Collection Policy.

7. Click Apply.

Related topics