STRM Log Manager Installation Guide

Transcription

1 Security Thret Response Mnger Relese Juniper Networks, Inc North Mthild Avenue Sunnyvle, CA USA Pulished:

2 Copyright Notice Copyright 2012 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Rdius, NetScreen, nd ScreenOS re registered trdemrks of Juniper Networks, Inc. in the United Sttes nd other countries. The Juniper Networks Logo, the Junos logo, nd JunosE re trdemrks of Juniper Networks, Inc. All other trdemrks, service mrks, registered trdemrks, or registered service mrks re the property of their respective owners. All specifictions re suject to chnge without notice. Juniper Networks ssumes no responsiility for ny inccurcies in this document or for ny oligtion to updte informtion in this document. Juniper Networks reserves the right to chnge, modify, trnsfer, or otherwise revise this puliction without notice. FCC Sttement The following informtion is for FCC complince of Clss A devices: This equipment hs een tested nd found to comply with the limits for Clss A digitl device, pursunt to prt 15 of the FCC rules. These limits re designed to provide resonle protection ginst hrmful interference when the equipment is operted in commercil environment. The equipment genertes, uses, nd cn rdite rdio-frequency energy nd, if not instlled nd used in ccordnce with the instruction mnul, my cuse hrmful interference to rdio communictions. Opertion of this equipment in residentil re is likely to cuse hrmful interference, in which cse users will e required to correct the interference t their own expense. The following informtion is for FCC complince of Clss B devices: The equipment descried in this mnul genertes nd my rdite rdio-frequency energy. If it is not instlled in ccordnce with NetScreen s instlltion instructions, it my cuse interference with rdio nd television reception. This equipment hs een tested nd found to comply with the limits for Clss B digitl device in ccordnce with the specifictions in prt 15 of the FCC rules. These specifictions re designed to provide resonle protection ginst such interference in residentil instlltion. However, there is no gurntee tht interference will not occur in prticulr instlltion. If this equipment does cuse hrmful interference to rdio or television reception, which cn e determined y turning the equipment off nd on, the user is encourged to try to correct the interference y one or more of the following mesures: Reorient or relocte the receiving ntenn. Increse the seprtion etween the equipment nd receiver. Consult the deler or n experienced rdio/tv technicin for help. Connect the equipment to n outlet on circuit different from tht to which the receiver is connected. Cution: Chnges or modifictions to this product could void the user's wrrnty nd uthority to operte this device. Disclimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. STRM Log Mnge Instlltion Guide Relese Copyright 2012, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History Septemer 2012 R2 STRM Instlltion Guide The informtion in this document is current s of the dte listed in the revision history. 2

3 CONTENTS ABOUT THIS GUIDE Documenttion Conventions Technicl Documenttion Requesting Technicl Support PREPARING FOR YOUR INSTALLATION Deploying STRM Log Mnger Additionl Hrdwre Requirements Additionl Softwre Requirements Browser Support Identifying Network Settings Prepring Your Network Hierrchy Identifying Security Monitoring Log Sources Prepring For HA INSTALLING STRM LOG MANAGER APPLIANCES A B C Instlling STRM Log Mnger Applince Instlling or Recovering Secondry HA STRM Log Mnger Applince Recovering Filed Primry HA STRM Log Mnger Applince Clering the Cche Accessing STRM Log Mnger INSTALLING A VIRTUAL APPLIANCE Before You Begin Prepring Your Virtul Mchine for STRM Log Mnger Instlltion Instlling STRM Log Mnger Softwre on Your Virtul Mchine CHANGING NETWORK SETTINGS Chnging Network Settings in n All-in-One Console Chnging the Network Settings of Console in Multi-System Deployment Chnging the Network Settings of Non-Console in Multi-System Deployment.. 42 RE-INSTALLING STRM LOG MANAGER Aout the Recovery Prtition Re-instlling STRM Log Mnger INDEX

4

5 ABOUT THIS GUIDE The provides you with informtion on setting up STRM. STRM pplinces re pre-instlled with softwre nd CentOS operting system; however, you cn instll STRM softwre on your own hrdwre using Red Ht Enterprise Linux. This guide ssumes working knowledge of networking nd Linux systems Documenttion Conventions The following conventions re used throughout this guide:juniper customer support STRM Vulnerility Mnger STRM Risk Mnger Indictes tht the procedure contins single instruction. Indictes tht the informtion provided is supplementl to the ssocited feture or instruction. CAUTION Indictes tht the informtion is criticl. A cution lerts you to potentil loss of dt or potentil dmge to n ppliction, system, device, or network. WARNING Indictes tht the informtion is criticl. A wrning lerts you to potentil dngers, threts, or potentil personl injury. Red ny nd ll wrnings crefully efore proceeding. Technicl Documenttion You cn ccess technicl documenttion, technicl notes, nd relese notes directly from the Juniper customer support wesite t Once you ccess the Juniper customer support wesite, locte the product nd

6 2 ABOUT THIS GUIDE softwre relese for which you require documenttion. Your comments re importnt to us. Plese send your e-mil comments out this guide or ny of the Juniper Networks documenttion to: Include the following informtion with your comments: Document title Pge numer Requesting Technicl Support Self-Help Online Tools nd Resources Opening Cse with JTAC Technicl product support is ville through the Juniper Networks Technicl Assistnce Center (JTAC). If you re customer with n ctive J-Cre or JNASC support contrct, or re covered under wrrnty, nd need postsles technicl support, you cn ccess our tools nd resources online or open cse with JTAC. JTAC policies For complete understnding of our JTAC procedures nd policies, review the JTAC User Guide locted t Product wrrnties For product wrrnty informtion, visit JTAC Hours of Opertion The JTAC centers hve resources ville 24 hours dy, 7 dys week, 365 dys yer. For quick nd esy prolem resolution, Juniper Networks hs designed n online self-service portl clled the Customer Support Center (CSC) tht provides you with the following fetures: Find CSC offerings: Serch for known ugs: Find product documenttion: Find solutions nd nswer questions using our Knowledge Bse: Downlod the ltest versions of softwre nd review relese notes: Serch technicl ulletins for relevnt hrdwre nd softwre notifictions: Join nd prticipte in the Juniper Networks Community Forum: Open cse online in the CSC Cse Mngement tool: You cn open cse with JTAC on the We or y telephone. Use the Cse Mngement tool in the CSC t

7 Requesting Technicl Support 3 Cll JTAC ( toll-free in the USA, Cnd, nd Mexico). For interntionl or direct-dil options in countries without toll-free numers, visit us t

8 4 ABOUT THIS GUIDE

9 1 PREPARING FOR YOUR INSTALLATION Your STRM Log Mnger deployment cn consist of STRM Log Mnger instlled on one or multiple systems. You cn use the STRM Log Mnger three-tier rchitecture to instll components on single server for smll enterprises or distriuted cross multiple servers for mximum performnce nd sclility in lrge enterprise environments. STRM Log Mnger lso provides High Avilility (HA) functionlity, which requires you to instll redundnt pplinces for ech system you wnt to provide HA protection. To ensure successful STRM Log Mnger deployment, dhere to the recommendtions in this document. This section provides informtion on the following: Deploying STRM Log Mnger (pge 5) Additionl Hrdwre Requirements (pge 7) Additionl Softwre Requirements (pge 7) Browser Support (pge 8) Identifying Network Settings (pge 8) Prepring Your Network Hierrchy (pge 9) Identifying Security Monitoring Log Sources (pge 9) Prepring For HA (pge 11) Deploying STRM Log Mnger You cn deploy STRM Log Mnger using STRM Log Mnger pplinces or STRM Log Mnger softwre instlled on your own hrdwre. This section provides informtion on the following: STRM Log Mnger Components (pge 6) Exmples of STRM Log Mnger Deployments (pge 6) A STRM Log Mnger pplince includes STRM Log Mnger softwre nd CentOS operting system. For further informtion out STRM Log Mnger pplinces, see the Hrdwre Instlltion Guide.

10 6 PREPARING FOR YOUR INSTALLATION STRM Log Mnger Components STRM Log Mnger components tht cn exist in your deployment include: For more informtion on ech STRM Log Mnger component, see the STRM Log Mnger Administrtion Guide. Console - Provides the user interfce for STRM Log Mnger. The Console provides rel time views nd reports. Using the Console, you cn lso mnge distriuted STRM Log Mnger deployments. You ccess the Console from stndrd we rowser. When you ccess the system, prompt is displyed for usernme nd pssword, which you configure during the instlltion process. You must lso hve Jv instlled on your desktop system. For informtion out softwre requirements, see Additionl Softwre Requirements (pge 7). Event Collector - The Event Collector gthers events from locl nd remote device sources. The Event Collector normlizes events, nd then sends the informtion to the Event Processor. Before sending informtion to the Event Processor, the Event Collector undles identicl events to conserve system usge. Event Processor - Processes events collected from one or more Event Collector. When received, the Event Processor correltes the informtion from STRM Log Mnger nd distriutes the informtion to the pproprite re, depending on the type of event. The Event Processor lso includes informtion gthered y STRM Log Mnger to indicte ehviorl chnges or policy violtions for the event. Rules re pplied to the events tht llow the Event Processor to process events ccording to the configured rules. Exmples of STRM Log Mnger Deployments The following figure shows n exmple of smll deployment using STRM Log Mnger nd STRM 5000 EP nd 2500EP pplinces. STRM Log Mnger STRM 5000 EP 2500 EP STRM 5000 EP 2500 EP

11 Additionl Hrdwre Requirements 7 The following figure shows n exmple of smll HA deployment using STRM Log Mnger nd STRM 500 QFC pplinces. Primry STRM 2500 Secondry STRM 2500 Primry STRM 500 QFC Secondry STRM 500 QFC Primry STRM -QFC-BFC Secondry STRM-QFC-BFC Additionl Hrdwre Requirements Before instlling your STRM Log Mnger systems, mke sure you hve ccess to the dditionl hrdwre components: Monitor nd keyord or seril console Uninterrupted Power Supply (UPS) CAUTION All STRM Log Mnger pplinces re 64-it. Mke sure tht you downlod the correct instlltion softwre for your OS. To mke sure tht your STRM Log Mnger dt is preserved during power filure, we highly recommend tht ll STRM Log Mnger pplinces or systems running STRM Log Mnger softwre tht store dt, such s Consoles nd Event Processors, e equipped with Uninterrupted Power Supply (UPS). Additionl Softwre Requirements Before instlling STRM Log Mnger, mke sure you hve the following pplictions instlled on ny desktop system you use to ccess the STRM Log Mnger user interfce: Jv Runtime Environment instlled on the desktop system you pln to use to view STRM Log Mnger. You cn downlod Jv 1.6.0_u24 t the following wesite: Adoe Flsh 10.x instlled on the your desktop used to ccess the STRM Log Mnger Console.

12 8 PREPARING FOR YOUR INSTALLATION Mke sure tht you instll Jv Runtime Environment on your desktop system, not the STRM Log Mnger pplince. Browser Support You must hve rowser instlled on your desktop system to ccess the STRM Log Mnger user interfce. STRM Log Mnger supports the following we rowsers: Internet Explorer 8.0 nd 9.0, with Comptiility View enled - For instructions on how to enle Comptiility View, see your rowser documenttion. Mozill Firefox - Juniper Networks is committed to supporting the Mozill Firefox we rowser. Due to Mozill's short relese cycles, it is not fesile to perform exhustive comptiility testing on ech Mozill Firefox relese. Juniper Networks hs dopted est effort strtegy to support the Mozill Firefox rowser, in which comptiility issues re ggressively trcked nd corrected s they re reported. Identifying Network Settings Before you instll STRM Log Mnger, you must gther the following informtion for ech system you wnt to instll: Hostnme IP ddress Network msk ddress Sunet msk Defult gtewy ddress Primry Domin Nme System (DNS) server ddress Secondry DNS server (optionl) ddress Pulic IP ddress for networks using Network Address Trnsltion (NAT) Emil server nme Network Time Protocol (NTP) server (Console only) or time server nme If you hve lredy instlled STRM Log Mnger r1 nd re recovering filed primry HA host, you must lso gther the following informtion from the STRM Log Mnger user interfce: Cluster Virtul IP Address Primry IP Address You cn find these IP ddresses in the System nd License Mngement window y pointing your mouse over the row for the HA cluster. For more informtion, see the STRM Log Mnger Administrtion Guide.

13 Prepring Your Network Hierrchy 9 Prepring Your Network Hierrchy STRM Log Mnger uses the network hierrchy to understnd your network trffic nd provide you with the ility to view network ctivity for your entire deployment. STRM Log Mnger supports ny network hierrchy tht cn e defined y rnge of IP ddresses. You cn crete your network hierrchy sed on mny different vriles, including geogrphicl or usiness units. For exmple, your network hierrchy my include corporte IP ddress rnges (internl or externl), physicl deprtments or res, mils servers, nd we servers. After you define the STRM Log Mnger components you wnt to dd to your network hierrchy nd instll STRM Log Mnger, you cn then configure the network hierrchy using the STRM Log Mnger Console. For ech STRM Log Mnger component you wnt to dd to your network hierrchy, use the following tle s jo id to record ech network component (oject) in your network mp. Tle 1-1 Network Hierrchy Description Nme IP/CIDR Vlue Weight At minimum, we recommend tht you define ojects in the network hierrchy for: Internl nd externl Demilitrized zones (DMZs) Virtul Privte Networks (VPNs) All internl IP ddress spce (for exmple, /8) Proxy servers (NAT) IP ddress rnge Server Network sunets Voice over IP (VoIP) sunets For more informtion, see the STRM Log Mnger Administrtion Guide - Setting Up STRM Log Mnger, Creting Your Network Hierrchy. Identifying Security Monitoring Log Sources STRM Log Mnger collects nd correltes events received from log sources, which re externl devices such s: Security equipment, such s firewlls, VPNs, nd Intrusion Detection Systems (IDSs) Host or ppliction security logs such s window logs Device Support Modules (DSMs) llow you to integrte STRM Log Mnger dt from these log sources.

14 10 PREPARING FOR YOUR INSTALLATION STRM Log Mnger utomticlly discovers log sources tht send syslog messges to n Event Collector. Automticlly discovered log sources re displyed in the Log Sources window within the Admin t. For more informtion, see the STRM Log Mnger Administrtion Guide. Tle 1-2 Log Sources You must dd non-syslog sed log sources to your deployment mnully. For ech non-syslog log source you wnt to dd to your deployment, record log source informtion in the following tle. For more informtion, see the Mnging Log Sources Guide. Log Source Type QTY Product Nme/ Version Link Speed & Type Msg Level Avg Log Rte (Event/Sec) No. of Users Network Loction Geogrphic Loction Crediility (0 to 10) Where: Log Source Type - Specifies the type of log source, such s firewll, router, or VPN log sources. QTY - Specifies how mny devices you hve of ech log source type. Product Nme/Version - Specifies the log source product nme nd version numer. Link Speed & Type - Specifies the mximum network link speed (in Kps) for firewll, router, nd VPN log sources. For the type, record the primry ppliction of the host system, for exmple, emil, nti-virus, domin controller, or worksttion. Msg Level - Specifies the messge level you wnt to log for this log source type. For exmple, criticl, informtionl, or deug. Avg Log Rte (Event/Sec) - Specifies the verge event rte per second. No. of Users - Specifies the mximum numer of hosts or users using or eing served y this log source. Network Loction - Specifies whether this log source is locted on the DMZ, Internet, Intrnet, or Extrnet. Geogrphic Loction - Specifies if the log sources re locted on the sme LAN s STRM Log Mnger or if they re sending logs over the Wide Are Network (WAN).

15 Prepring For HA 11 Crediility - Specifies the integrity of n event s determined y the crediility rting from log sources. Crediility increses s multiple sources report the sme event. Prepring For HA Before deploying HA in your environment, ensure your HA hosts dhere to the following requirements: The secondry host must hve the sme STRM Log Mnger softwre version nd ptch level instlled s the primry host in the HA cluster. The secondry host s memory must e equl to or greter thn the primry host s memory. The secondry host must e locted on the sme sunet s the primry host. The secondry host s /store prtition must e lrger thn the /store prtition on the primry host. If you pln to enle disk synchroniztion, we recommend tht there is t lest 1 GB connection etween the primry host nd secondry host. If you pln for your HA hosts to shre externl storge, we recommend tht there is t lest 1 GB connection etween ech HA host nd your externl storge solution.

16

17 2 INSTALLING STRM LOG MANAGER APPLIANCES This section provides informtion on instlling your STRM Log Mnger pplince. A STRM Log Mnger pplince includes STRM Log Mnger softwre nd CentOS operting system. This section provides informtion for how to set up your pplince. For more informtion out pplinces, see the Hrdwre Instlltion Guide. Choose which type of instlltion you wnt to perform: Instlling STRM Log Mnger Applince (pge 13) Instlling or Recovering Secondry HA STRM Log Mnger Applince (pge 17) Recovering Filed Primry HA STRM Log Mnger Applince (pge 20) Instlling STRM Log Mnger Applince Step 1 To instll STRM Log Mnger pplince: Prepre your pplince. c Instll ll necessry hrdwre. For informtion on your STRM Log Mnger pplince, see the Hrdwre Instlltion Guide. Choose one of the following options: - Connect lptop to the seril port on the rer of the pplince. If you use lptop to connect to the system, you must use terminl progrm, such s HyperTerminl, to connect to the system. Mke sure you set Connect Using to the pproprite COM port of the seril connector nd Bits per second to You must lso set Stop Bits (1), Dt its (8), nd Prity (None). - Connect keyord nd monitor to their respective ports. For more informtion on pplince ports, see the Hrdwre Instlltion Guide. Power on the system nd log in: Usernme: root

18 14 INSTALLING STRM LOG MANAGER APPLIANCES Step 2 The usernme is cse sensitive. d Press Enter. The End User License Agreement (EULA) is displyed. e Red the informtion in the window. Press the Spcer to dvnce ech window until you hve reched the end of the document. Choose your type of setup: Highlight norml, nd then press the spcer to select it. Press Enter to select Next. To select n item on n instlltion window, press the Up nd Down Arrow keys or press the Pge Up nd Pge Down Keys to mke selection. Step 3 Specify if you wnt to instll Console or non-console system: Highlight one of the following options nd press the spcer to select tht option: Yes - Select this option if this system is Console. No - Select this option if this system is not Console. To select n option, highlight the option nd press the spcer to plce n X in the prentheses. If you select Yes to indicte tht your system is Console, n error messge is displyed if your system hs less thn 8 GB of RAM. We require tht you upgrde the memory on your system efore instlling STRM Log Mnger on your system. Step 4 Step 5 Press Enter to select Next. The Tuning Templte window is displyed. Select tuning templte: Select the Logger templte. Press Enter to select Next. Highlight the method you wnt to use to set the dte nd time, nd then press the spcer to select tht option: Mnul - Select this option to mnully input the time nd dte. Press the T key to select the Next option nd press Enter. The Current Dte nd Time window is displyed. Go to Step 6.

19 Instlling STRM Log Mnger Applince 15 Step 6 Step 7 Step 8 Step 9 Server - Select this option to specify your time server. Press the T key to select the Next option nd press Enter. The Enter Time Server window is displyed. Go to Step 7. To mnully enter the time nd dte: Type the current dte nd time. Press the T key to move to the Next option nd press Enter. c Go to Step 8. To specify time server: In the text field, type the time server nme or IP ddress. Press the T key to move to the Next option nd press Enter. The Time Zone Continent window is displyed. Select your time zone continent re. Press Enter to select Next. The Time Zone Region window is displyed. The options displyed in this window re regions tht re ssocited with the continent or re previously selected. Step 10 Step 11 Step 12 Step 13 Step 14 Step 15 Step 16 Select your time zone region. Press Enter to select Next. Choose which internet protocol version to use: Highlight the internet protocol version you wnt to use, nd press the spcer to select it: - IPv4 - IPv6 Press Enter to select Next nd specify your mngement interfce. The window displys up to mximum of four interfces depending on your hrdwre configurtion. Ech interfce with physicl link is denoted with (+) symol. Highlight the interfce you wnt to specify s the mngement interfce nd press the spcer to select it. Press Enter to select Next. Choose one of the following options: If you re using IPv4 s your Internet protocol, go to Step 18. If you re using IPv6 s your Internet protocol, go to Step 16. Choose one of the following options: To utomticlly configure for IPv6, select Yes nd press Enter. The utomtic configurtion cn tke n extended period of time. Go to Step 18.

20 16 INSTALLING STRM LOG MANAGER APPLIANCES Step 17 Step 18 To mnully configure for IPv6, select No nd press Enter. Go to Step 17. To enter network informtion to use for IPv6: Type the vlues for the Hostnme nd Emil server. Press the T key to move to the Next option nd press Enter. Configure the STRM Log Mnger network settings: Enter vlues for the following prmeters: Hostnme - Type fully qulified domin nme s the system hostnme. IP Address - Type the IP ddress of the system. Network Msk - Type the network msk ddress for the system. Gtewy - Type the defult gtewy of the system. Primry DNS - Type the primry DNS server ddress. Secondry DNS - Optionl. Type the secondry DNS server ddress. Pulic IP - Optionl. Type the Pulic IP ddress of the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged y your network dministrtor. The Pulic IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. Emil Server - Type the nme of the emil server. If you do not hve n emil server, type loclhost in this field. Press the T key to move to the Next option nd press Enter. If you re chnging network settings using the qchnge_netsetup utility, press the T key to move to the Finish option nd press Enter. See Chnging Network Settings (pge 37). Step 19 Configure the STRM Log Mnger root pssword: Type your pssword. Press the T key to move to the Next option nd press Enter. The Confirm New Root Pssword window is displyed. c Retype your new pssword to confirm. d Press the T key to move to the Finish option nd press Enter. A series of messges re displyed s STRM Log Mnger continues with the instlltion. This process typiclly tkes severl minutes. The Configurtion is Complete window is displyed. e Press Enter to select OK. You re now redy to ccess STRM Log Mnger. For more informtion on ccessing STRM Log Mnger, see Accessing STRM Log Mnger (pge 25).

21 Instlling or Recovering Secondry HA STRM Log Mnger Applince 17 Instlling or Recovering Secondry HA STRM Log Mnger Applince Step 1 Before deploying HA in your environment, ensure your HA hosts dhere to the following requirements: The secondry host must hve the sme STRM Log Mnger softwre version instlled s the primry host in the HA cluster. The secondry host s memory must e equl to or greter thn the primry host s memory. The secondry host must e locted on the sme sunet s the primry host. The secondry host s /store prtition must e lrger thn the /store prtition on the primry host. If you pln to enle disk synchroniztion, we recommend tht there is t lest 1 GB connection etween the primry host nd secondry host. If you pln for your HA hosts to shre externl storge, we recommend tht there is t lest 1 GB connection etween ech HA host nd your externl storge solution. To instll or recover your secondry HA pplince for STRM Log Mnger pplince: Prepre your pplince. Instll ll necessry hrdwre. For informtion on your STRM Log Mnger pplince, see the Hrdwre Instlltion Guide. c Choose one of the following options: - Connect lptop to the seril port on the rer of the pplince. If you use lptop to connect to the system, you must use terminl progrm, such s HyperTerminl, to connect to the system. Mke sure you set Connect Using to the pproprite COM port of the seril connector nd Bits per second to You must lso set Stop Bits (1), Dt its (8), nd Prity (None). - Connect keyord nd monitor to their respective ports. For more informtion on pplince ports, see the Hrdwre Instlltion Guide. Power on the system nd log in: Usernme: root The usernme is cse sensitive. d e Press Enter. The End User License Agreement (EULA) is displyed. Red the informtion in the window. Press the Spcer to dvnce ech window until you hve reched the end of the document.

22 18 INSTALLING STRM LOG MANAGER APPLIANCES Step 2 Specify your secondry device type: Choose one of the following options: If you re instlling secondry device for Console, highlight This system is stnd-y for console, nd then press the spcer to select the option. If you re not instlling secondry device for Console, highlight This system is stnd-y for non-console, nd then press the spcer to select the option. Press Enter to select Next. To select n item on n instlltion window, press the Up nd Down Arrow keys or press the Pge Up nd Pge Down Keys to mke selection. Step 3 Step 4 Step 5 Step 6 Step 7 Highlight the method you wnt to use to set the dte nd time, nd then press the spcer to select tht option: Mnul - Select this option to mnully input the time nd dte. Press the T key to select the Next option nd press Enter. The Current Dte nd Time window is displyed. Go to Step 4. Server - Select this option to specify your time server. Press the T key to select the Next option nd press Enter. The Enter Time Server window is displyed. Go to Step 5. To mnully enter the time nd dte: Type the current dte nd time. Press the T key to move to the Next option nd press Enter. c Go to Step 10. To specify time server: In the text field, type the time server nme or IP ddress. Press the T key to move to the Next option nd press Enter. The Time Zone Continent window is displyed. Select your time zone continent or re. Press Enter to select Next. The Time Zone Region window is displyed. The options displyed in this window re regions tht re ssocited with the continent or re previously selected. Step 8 Step 9 Step 10 Select your time zone region. Press Enter to select Next. Choose which internet protocol version to use: Select IPv4.

23 Instlling or Recovering Secondry HA STRM Log Mnger Applince 19 Press Enter to select Next nd specify your mngement interfce. The window displys up to mximum of four interfces depending on your hrdwre configurtion. Ech interfce with physicl link is denoted with (+) symol. IPv6 is not supported in n HA environment. If you re instlling softwre or n pplince nd you select the IPv6 option, n error messge is displyed. In this cse, select Bck nd then select IPv4. You cn then proceed to next step in your instlltion. Step 11 Step 12 Step 13 Highlight the interfce you wnt to specify s the mngement interfce nd press the spcer to select it. Press Enter to select Next. To configure the STRM Log Mnger network settings: Enter vlues for the following prmeters: Hostnme - Type fully qulified domin nme s the system hostnme. IP Address - Type the IP ddress of the system. If you re recovering n HA pplince, the IP ddress is the Primry HA IP ddress, which you cn identify in the System nd License Mngement window y pointing your mouse over the row for the HA cluster. For more informtion on mnging HA, see the STRM Log Mnger Administrtion Guide - Mnging High Avilility. Network Msk - Type the network msk ddress for the system. Gtewy - Type the defult gtewy of the system. Primry DNS - Type the primry DNS server ddress. Secondry DNS - Optionl. Type the secondry DNS server ddress. Pulic IP - Optionl. Type the Pulic IP ddress of the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged y your network dministrtor. The Pulic IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. Emil Server - Type the nme of your emil server. If you do not hve n emil server, type loclhost in this field. Press the T key to move to the Next option nd press Enter. If you re chnging network settings using qchnge_netsetup, press the T key to move to the Finish option nd press Enter. See Chnging Network Settings (pge 37).

24 20 INSTALLING STRM LOG MANAGER APPLIANCES Step 14 Step 15 Step 16 To configure the STRM Log Mnger root pssword: c d e Type your pssword. Press the T key to move to the Next option nd press Enter. The Confirm New Root Pssword window is displyed. Retype your new pssword to confirm. Press the T key to move to the Finish option nd press Enter. A series of messges re displyed s STRM Log Mnger continues with the instlltion. This process typiclly tkes severl minutes. The Configurtion is Complete window is displyed. Press Enter to select OK. Log in to the STRM Log Mnger user interfce. See Accessing STRM Log Mnger (pge 25). Configure your HA cluster. For more informtion on configuring your HA cluster, see the STRM Log Mnger Administrtion Guide - Mnging High Avilility. Recovering Filed Primry HA STRM Log Mnger Applince Before you recover filed primry HA pplince, you must gther the following informtion from the STRM Log Mnger user interfce: Cluster Virtul IP Address Primry IP Address You cn find these IP ddresses in the System nd License Mngement window y pointing your mouse over the row for the HA cluster. For more informtion, see the STRM Log Mnger Administrtion Guide - Mnging High Avilility. CAUTION If your HA cluster uses shred storge, you must mnully configure iscsi. For more informtion out configuring iscsi, see the Configuring iscsi technicl note. Step 1 To recover filed primry HA pplince: Prepre your pplince. Instll ll necessry hrdwre. For informtion on your STRM Log Mnger pplince, see the Hrdwre Instlltion Guide. Choose one of the following options: - Connect lptop to the seril port on the rer of the pplince.

25 Recovering Filed Primry HA STRM Log Mnger Applince 21 c If you use lptop to connect to the system, you must use terminl progrm, such s HyperTerminl, to connect to the system. Mke sure you set Connect Using to the pproprite COM port of the seril connector nd Bits per second to You must lso set Stop Bits (1), Dt its (8), nd Prity (None). - Connect keyord nd monitor to their respective ports. For more informtion on pplince ports, see the Hrdwre Instlltion Guide. Power on the system nd log in: Login: root The usernme is cse sensitive. Step 2 Step 3 Step 4 d e Press Enter. The End User License Agreement (EULA) is displyed. Red the informtion in the window. Press the Spcer to dvnce ech window until you hve reched the end of the document. Specify your secondry device type: Choose one of the following options: If you re instlling secondry device for Console, using the up/down rrow keys, highlight This system is stnd-y for console, nd then press the spcer to select the option. If you re not instlling secondry device for Console, using the up/down rrow keys, highlight This system is stnd-y for non-console, nd then press the spcer to select the option. Press Enter to select Next. Set the time nd dte. Highlight the method you wnt to use to set the dte nd time, nd then press the spcer to select tht option: Mnul - Select this option to mnully input the time nd dte. Press the T key to select the Next option nd press Enter. The Current Dte nd Time window is displyed. Go to Step 5. Server - Select this option to specify your time server. Press the T key to select the Next option nd press Enter. The Enter Time Server window is displyed. Go to Step 6. To select n item on n instlltion window, press the Up nd Down Arrow keys or press the Pge Up nd Pge Down Keys to mke selection. Step 5 To mnully enter the time nd dte: Type the current dte nd time. Press the T key to move to the Next option nd press Enter.

26 22 INSTALLING STRM LOG MANAGER APPLIANCES Step 6 Step 7 Step 8 c Go to Step 11. To specify time server: In the text field, type the time server nme or IP ddress. Press the T key to move to the Next option nd press Enter. The Time Zone Continent window is displyed. Select your time zone continent or re. Press Enter to select Next. The Time Zone Region window is displyed. The options tht re displyed in this window re regions tht re ssocited with the continent or re previously selected. Step 9 Step 10 Step 11 Select your time zone region. Press Enter to select Next. Choose which internet protocol version to use. Select IPv4 Press Enter to select Next nd specify your mngement interfce. The window displys up to mximum of four interfces depending on your hrdwre configurtion. Ech interfce with physicl link is denoted with (+) symol. IPv6 is not supported in n HA environment. If you re instlling softwre or n pplince nd you select the IPv6 option, n error messge is displyed. In this cse, select Bck nd then select IPv4. You cn then proceed to next step in your instlltion. Step 12 Step 13 Step 14 Step 15 Highlight the interfce you wnt to specify s the mngement interfce nd press the spcer to select it. Press Enter to select Next. To configure your Cluster Virtul IP ddress: Type the Cluster Virtul IP ddress. The Cluster Virtul IP ddress is the originl IP ddress of the primry HA system. You cn find this IP ddress in the System nd License Mngement window y pointing your mouse over the row for the HA cluster. Press Enter to select Next. To configure the STRM Log Mnger network settings: Enter vlues for the following prmeters: Hostnme - Type fully qulified domin nme s the system hostnme. IP Address - Type the IP ddress of the system.

27 Recovering Filed Primry HA STRM Log Mnger Applince 23 If you re recovering n HA pplince, the IP ddress is the Primry HA IP ddress, which you cn identify in the System nd License Mngement window y pointing your mouse over the row for the HA cluster. For more informtion on mnging HA, see the STRM Log Mnger Administrtion Guide - Mnging High Avilility. Network Msk - Type the network msk ddress for the system. Gtewy - Type the defult gtewy of the system. Primry DNS - Type the primry DNS server ddress. Secondry DNS - Optionl. Type the secondry DNS server ddress. Pulic IP - Optionl. Type the Pulic IP ddress of the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged y your network dministrtor. The Pulic IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. Emil Server - Type the nme of your emil server. If you do not hve n emil server, type loclhost in this field. Press the T key to move to the Next option nd press Enter. If you re chnging network settings using qchnge_netsetup, press the T key to move to the Finish option nd press Enter. See Chnging Network Settings (pge 37). Step 16 Step 17 Step 18 To configure the STRM Log Mnger root pssword: Type your pssword. Press the T key to move to the Next option nd press Enter. The Confirm New Root Pssword window is displyed. c Retype your new pssword to confirm. d Press the T key to move to the Finish option nd press Enter. A series of messges re displyed s STRM Log Mnger continues with the instlltion. This process typiclly tkes severl minutes. The Configurtion is Complete window is displyed. e Press Enter to select OK. Log in to the STRM Log Mnger user interfce. See Accessing STRM Log Mnger (pge 25). Restore the filed primry HA system. For more informtion on restoring filed primry HA system, see the STRM Log Mnger Administrtion Guide - Mnging High Avilility.

28 24 INSTALLING STRM LOG MANAGER APPLIANCES Clering the Cche If you hve troule ccessing the STRM Log Mnger user interfce fter you instll STRM Log Mnger 2010.r1, we recommend tht you cler your Jv nd we rowser cche. To cler your cche nd ccess the STRM Log Mnger user interfce: Mke sure tht you hve Jv Runtime Environment instlled on your desktop system. You cn downlod Jv 1.6.0_u20 t the following wesite: Step 1 Cler your Jv cche: On your desktop, select Strt > Control Pnel. The Control Pnel is displyed. Doule-click the Jv icon. The Jv Control Pnel is displyed. If you re using Microsoft Windows 7 s your operting system, the Jv icon my e locted under the Progrms pne, depending on how your Control Pnel is configured to disply fetures. Step 2 Step 3 c In the Temporry Internet Files pne, click View. The Jv Cche Viewer is displyed. d Select ll STRM Log Mnger Deployment Editor entries. e Click the Delete icon. f Click Close. Open your we rowser. Cler the cche of your we rowser: Before you cler the cche, mke sure you hve only one instnce of your rowser open. If you hve multiple versions of your rowser open, the cche fils to cler. c If you re using Internet Explorer 7.0 or 8.0, select Tools > Delete Browsing History. If you re using Internet Explorer 9.0, click the ger icon in right corner of the rowser window, select Internet Options > Generl, nd then click Delete in the Browsing History pne. If you re using Mozill Firefox 3.6.x nd ove, select Tools > Cler Recent History > Cler Now.

29 Accessing STRM Log Mnger 25 If you re using Mozill Firefox, you must cler the cche in Internet Explorer s well s in Mozill Firefox. Step 4 Log in to STRM Log Mnger. For more informtion on ccessing nd using STRM Log Mnger, see the STRM Log Mnger Users Guide or STRM Log Mnger Administrtion Guide. Accessing STRM Log Mnger Step 1 Step 2 To ccess the STRM Log Mnger user interfce: Open your we rowser. Log in to STRM Log Mnger: Address> Where <IP Address> is the IP ddress of the STRM Log Mnger system. The defult vlues re: Usernme: dmin Pssword: <root pssword> Where <root pssword> is the pssword ssigned to STRM Log Mnger during the instlltion process. If you re using Mozill Firefox, you must dd n exception to Mozill Firefox to log in to STRM Log Mnger. For more informtion, see your Mozill documenttion. If you re using Internet Explorer, wesite security certificte messge is displyed. You must select the Continue to this wesite option to log in to STRM Log Mnger. Step 3 Click Login To STRM Log Mnger. For your STRM Log Mnger Console, defult license key provides you ccess to STRM Log Mnger for five weeks. For more informtion on the license key, see the STRM Log Mnger Administrtion Guide.

30

31 A INSTALLING A VIRTUAL APPLIANCE A virtul pplince enles the sme visiility nd functionlity in your virtul network infrstructure tht the STRM Log Mnger pplince offers in your physicl environment. The STRM Log Mnger 8099 virtul pplince is STRM Log Mnger system mnges nd stores events from vrious network devices. The STRM Log Mnger 8099 virtul pplince includes n on-ord Event Collector, Event Processor, nd internl storge for events.the STRM Log Mnger 8099 virtul pplince supports: 1,000 Events Per Second (EPS), depending on your license 2 TB or lrger dedicted event storge This section provides informtion on the following: Before You Begin Prepring Your Virtul Mchine for STRM Log Mnger Instlltion Instlling STRM Log Mnger Softwre on Your Virtul Mchine After you instll your virtul pplinces, you cn ccess the deployment editor nd dd your virtul pplinces to your deployment. For more informtion on connecting pplinces using the deployment editor, see the STRM Log Mnger Administrtion Guide. Before You Begin Before you instll your virtul pplince, note the following: Virtul pplinces require VMwre ESXi 4.1. You must hve VMwre client instlled on your desktop. VMwre server pplictions re undled with client softwre. For exmple, ESXi 4.1 is undled with VMwre vsphere client 4.1. If your server/client configurtion differs, we recommend you upgrde your VMwre server nd client. For more informtion, see 8 GB of free memory is required y the VMwre host for STRM Log Mnger GB is optiml. 36 GB of free disk spce is required on ll virtul pplince types.

32 30 Prepring Your Virtul Mchine for STRM Log Mnger Instlltion Creting your Virtul Mchine Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 This section provides informtion on the following: Creting your Virtul Mchine Instlling the STRM Log Mnger ISO on the Virtul Mchine To crete your virtul mchine: Access your vsphere Client. Select File > New > Virtul Mchine. The Crete New Virtul Mchine window is displyed. In the Configurtion pne, select the Custom option nd click Next. In the Nme field, type unique nme for the virtul mchine nd click Next. In the right pne, select the dtstore where you wnt to store the virtul mchine nd click Next. In the Virtul Mchine Version pne, select the Virtul Mchine Version: 7 option nd click Next. Select the guest Operting System (OS) for the STRM Log Mnger virtul pplince: In the Guest Operting System pne, select the Linux option. From the Version list ox, select Red Ht Enterprise Linux 5 (64-it) nd click Next. From the Numer of virtul processors list ox, select the numer of processors you wnt for the virtul mchine nd click Next. You must select minimum of 2 processors. In the Memory Configurtion pne, provide minimum of 8 GB for memory: In the Memory Size field, type or select 8 or higher. In the list ox, select GB. Configure your network connections: From the How mny NICs do you wnt to connect list ox, select the numer of Network Interfce Controllers (NICs) you wnt to dd. You must dd t lest one NIC. For ll NICs, select VMXNET3 from the Adpter list ox. c Click Next. In the SCSI Controller pne, select VMwre Prvirtul nd click Next. In the Disk pne, select Crete new virtul disk. Configure the virtul disk size nd select provisioning policy: In the Cpcity pne, type or select 36 or higher nd select GB from the list ox.

33 Instlling STRM Log Mnger Softwre on Your Virtul Mchine 31 Step 14 Step 15 In the Disk Provisioning pne, select the Allocte nd commit spce on demnd (Thin provisioning) check ox. c Click Next. The Advnced Options pge is displyed. Do not configure the options on this pge. Click Next. The Redy to Complete pge is displyed. Review the settings for your new virtul mchine nd edit the settings if required. Click Finish. Your virtul mchine is redy for optiml performnce when running your STRM Log Mnger virtul pplince. Instlling the STRM Log Mnger ISO on the Virtul Mchine Step 1 Step 2 Step 3 To instll STRM Log Mnger softwre on virtul pplince: Otin the STRM Log Mnger softwre from the Juniper customer support wesite. In the left pne of your VMwre vsphere Client, select your virtul mchine from the menu tree. In the right pne, click the Summry t. Step 4 In the Commnds pne, click Edit Settings. The Virtul Mchine Properties window is displyed. Step 5 In the left pne, click CD/DVD Drive 1. Step 6 Step 7 Step 8 Step 9 In the Device Sttus pne, select the Connect t power on check ox. In the Device Type pne, select Dtstore ISO File nd click Browse. The Browse Dtstores window is displyed. Locte nd select the ISO file nd click Open. Click OK. The virtul mchine is now redy to power up nd instll STRM Log Mnger. For more informtion, see Instlling STRM Log Mnger Softwre on Your Virtul Mchine. Instlling STRM Log Mnger Softwre on Your Virtul Mchine Step 1 Step 2 To instll STRM Log Mnger softwre on your virtul mchine: Access your vsphere Client. In the menu tree, right-click your virtul mchine nd select Power > Power On.

34 32 Step 3 Log in to the virtul mchine: Usernme: root The usernme is cse sensitive. Step 4 Step 5 Step 6 Press Enter. The End User License Agreement (EULA) is displyed. Red the informtion in the window. Press the Spcer to dvnce ech window until you hve reched the end of the document. Choose your type of setup: Highlight norml, nd then press the Spcer to select it. Press Enter to select Next. To select n item on n instlltion window, press the Up nd Down Arrow keys or press the Pge Up nd Pge Down Keys to mke selection. Step 7 Specify if you wnt to instll Console or non-console system. Yes - Select this option if this system is Console. No - Select this option if this system is not Console. To select your chosen option, mke sure you highlight the option nd press the Spcer to plce n X in the prentheses. If you select Yes to indicte tht your system is Console, n error messge is displyed if your system hs less thn 8 GB of RAM. We require tht you upgrde the memory on your system efore instlling STRM Log Mnger on your system. Step 8 Step 9 Step 10 c Press Enter to select Next. Select tuning templte: Select the Enterprise templte. Press Enter to select Next. Highlight the method you wnt to use to set the dte nd time, nd then press the Spcer to select tht option: Mnul - Select this option to mnully input the time nd dte. Press the T key to select the Next option nd press Enter. The Current Dte nd Time window is displyed. Go to Step 10. Server - Select this option to specify your time server. Press the T key to select the Next option nd press Enter. The Enter Time Server window is displyed. Go to Step 11. To mnully enter the time nd dte: Type the current dte nd time.

35 Instlling STRM Log Mnger Softwre on Your Virtul Mchine 33 Step 11 Step 12 Step 13 Press the T key to move to the Next option nd press Enter. c Go to Step 12. To specify time server: In the text field, type the time server nme or IP ddress. Press the T key to move to the Next option nd press Enter. The Time Zone Continent window is displyed. Select your time zone continent or re. Press Enter to select Next. The Time Zone Region window is displyed. The options tht re displyed in this window re regions tht re ssocited with the continent or re you previously selected. Step 14 Step 15 Step 16 Step 17 Step 18 Step 19 Step 20 Step 21 Select your time zone region. Press Enter to select Next. Choose which internet protocol version to use. Select one of the following options: - IPv4 - IPv6 Press Enter to select Next to specify your mngement interfce. The window displys up to mximum of four interfces depending on your hrdwre configurtion. Ech interfce with physicl link is denoted with (+) symol. Highlight the interfce you wnt to specify s the mngement interfce nd press the Spcer to select it. Press Enter to select Next. Choose one of the following options: If you re using IPv4 s your Internet protocol, go to Step 22. If you re using IPv6 s your Internet protocol, go to Step 20. Choose one of the following options: To utomticlly configure for IPv6, select Yes nd press Enter. The utomtic configurtion cn tke n extended period of time. Go to Step 22. To mnully configure for IPv6, select No nd press Enter. Go to Step 21. To enter network informtion to use for IPv6: Type the vlues for the Hostnme nd Emil server. Press the T key to move to the next option nd press Enter.

36 34 Step 22 Configure the STRM Log Mnger network settings: Enter vlues for the following prmeters: Hostnme - Type fully qulified domin nme s the system hostnme. IP Address - Type the IP ddress of the system. Network Msk - Type the network msk ddress for the system. Gtewy - Type the defult gtewy of the system. Primry DNS - Type the primry DNS server ddress. Secondry DNS - Optionl. Type the secondry DNS server ddress. Pulic IP - Optionl. Type the Pulic IP ddress of the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged y your network dministrtor. The Pulic IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. Emil Server - Type the emil server. If you do not hve n emil server, type loclhost in this field. Press the T key to move to the Next option nd press Enter. If you re chnging network settings using the qchnge_netsetup utility, press the T key to move to the Finish option nd press Enter. See Chnging Network Settings. Step 23 Configure the STRM Log Mnger root pssword: Type your pssword. Press the T key to move to the Next option nd press Enter. The Confirm New Root Pssword window is displyed. c Retype your new pssword to confirm. d Press the T key to move to the Finish option nd press Enter. A series of messges re displyed s STRM Log Mnger continues with the instlltion. This process typiclly tkes severl minutes. The Configurtion is Complete window is displyed. e Press Enter to select OK. You re now redy to ccess STRM Log Mnger.