Manual Chapter :
Deploying a Data Collection Device
Applies To:
Show VersionsBIG-IQ Centralized Management
- 6.0.0
Deploying a Data Collection Device
How do I deploy a
data collection device cluster?
To manage the data generated by BIG-IP® devices on BIG-IQ® Centralized
Management, you deploy a network of devices called a
data
collection device (DCD) cluster
, and then configure that cluster to meet your
business needs.To deploy a DCD cluster, you should:
- Prepare your network environment and architecture (refer toPlanning a BIG-IQ Centralized Management DeploymentinPlanning a BIG-IQ Centralized Management Deploymentonsupport.f5.comfor details).
- Install and configure the platform you plan to use to run the BIG-IQ system. The platform can either be a physical device or a virtual device. To use a physical device, you need a BIG-IQ 7000 series device. To use a virtual device, the solution you choose depends on the environment you choose. Supported platforms for this release are listed below. Use the guide appropriate for the platform you use to complete the installation. All of these guides are posted onsupport.f5.com.If you choose this platform:Refer to this guide for installation details:BIG-IQ 7000 SeriesPlatform Guide: BIG-IQ 7000 SeriesAmazon Web ServicesF5 BIG-IQ Centralized Management 6.0.0 and Amazon Web Services: SetupCitrix XenServer:F5 BIG-IQ Centralized Management 6.0.0 and Citrix XenServer: SetupKVMF5 BIG-IQ Centralized Management 6.0.0 and Linux KVM: SetupMicrosoft AzureF5 BIG-IQ Centralized Management 6.0.0 and Microsoft Azure: SetupMicrosoft Hyper-VF5 BIG-IQ Centralized Management 6.0.0 and Microsoft Hyper-V: SetupVMwareF5 BIG-IQ Centralized Management 6.0.0 and VMware ESXi: SetupXen ProjectF5 BIG-IQ Centralized Management 6.0.0 and Linux Xen Project: Setup
- Discover and activate the DCDs.
- Define an external location to store snapshots.
- Enable data collection for the DCD cluster.
- Configure a BIG-IP system to send alerts or events to the cluster (if needed).
- Configure the BIG-IQ system that manages the DCD cluster for HA (if needed).
Licensing and setting up a
data collection
device
The BIG-IQ® data collection device
runs as a virtual machine in supported hypervisors, or on the BIG-IQ 7000 series platform. You
license the data collection device (DCD) using the base registration key. The
base registration key
is a character string that the F5 license
server uses to provide access to data collection device features.You
must use the correct license type when you license a DCD. You must use a license that uses
the SKU: F5-BIQ-VE-LOG-NODE.
You license data collection device in one of the following ways:
- If the system has access to the internet, you can have the data collection device contact the F5 license server and automatically activate the license.
- If the system is not connected to the internet, you can manually retrieve the activation key from a system that is connected to the internet, and transfer it to the data collection device.
- If your data collection device is in a closed-circuit network (CCN) that does not allow you to export any encrypted information, you must open a case with F5 support.
When you license the data collection device, you:
- Specify a host name for the system.
- Assign a management port IP address.
- Specify the IP address of your DNS server and the name of the DNS search domain.
- Specify the IP address of your Network Time Protocol (NTP) servers and select a time zone.
- Change the administrator’s default admin and root passwords.
Automatic license and initial setup for a DCD
You must have a base
registration key before you can license the BIG-IQ system. If you do not have a base
registration key, contact the F5 Networks sales group (
f5.com
). If the data collection device system is connected to the public internet, you can follow these steps to automatically perform the license activation and perform the initial setup.
- Use a browser to log in to BIG-IQ by typinghttps://, where<management_IP_address><management_IP_address>is the address you specified for device management.
- In theBase Registration Keyfield, type or paste the BIG-IQ registration key.If you are setting up a data collection device, you have to use a registration key that supports a data collection device license.
- In theAdd-On Keysfield, paste any additional license key you have.
- To add another additional add-on key, click the+sign and paste the additional key in the newAdd-On Keysfield.
- For theActivation Methodsetting, selectAutomatic, and click theActivatebutton.
- ClickNext.If you are setting up this device for the first time, the Accept User Legal Agreement screen opens.
- To accept the license agreement, click theAgreebutton.
- Click theNextbutton at the bottom of the screen.If your license supports both BIG-IQ Data Collection Device and BIG-IQ Central Management Console, the System Personality screen displays. Otherwise the Management Address screen opens.
- If you are prompted with the System Personality screen, select the option you're licensed for, and then clickOK. If you are not prompted, proceed to the next step.You cannot undo this choice. Once you license a device as a BIG-IQ Management Console, you can't change your mind and license it as a Data Collection Device.The Management Address screen opens.
- In theHostnamefield, type a fully-qualified domain name (FQDN) for the system.The FQDN can consist of letters and numbers, as well as the characters underscore ( _ ), dash ( - ), or period ( . ).
- In theManagement Port IP AddressandManagement Port Routefields, type the IP address for the management port IP address and route.The management port IP address must be in Classless Inter-Domain Routing (CIDR) format. For example:10.10.10.10/24.
- Specify what you want the DCD to use for theDiscovery Address.The DCD advertises this address to other devices that want to communicate with it. DCD nodes communicate using their respective discovery addresses.
- To use the management IP address, selectUse Management Address.
- To use the internal self IP address, selectSelf IP Address, and type the IP address.F5 strongly recommends using the internal self IP address as the Discovery Address for a DCD.The self IP address must be in Classless Inter-Domain Routing (CIDR) format. For example:10.10.10.10/24.
- Click theNextbutton at the bottom of the screen.The Services screen opens.
- In theDNS Lookup Serversfield, type the IP address of your DNS server.You can click theTest Connectionbutton to verify that BIG-IQ can reach that IP address.
- In theDNS Search Domainsfield, type the name of your search domain.The DNS search domain list allows the BIG-IQ system to search for local domain lookups to resolve local host names.
- In theTime Serversfield, type the IP addresses of your Network Time Protocol (NTP) server.You can click theTest Connectionbutton to verify that BIG-IQ can reach the IP address.
- From theTime Zonelist, select your local time zone.
- Click theNextbutton at the bottom of the screen.The Master Key screen opens.
- For thePassphrase, type a phrase that satisfies the requirements specified on screen, and then type the same phrase forConfirm Passphrase.The DCD uses the pass phrase to generate a Master Key. This pass phrase must be the same on all of the devices in the DCD cluster. Make sure you keep track of the pass phrase, because it cannot be recovered if you lose it
- Click theNextbutton at the bottom of the screen.The Password screen opens.If you are setting up a Microsoft Azure VE, and you type an entry in any of the fields, you will not be able to continue successfully. The only way to proceed is to leave all of the fields empty and click theNextbutton at the bottom of the screen. This allows the system to use the first-time access credentials you specified previously.
- In theOld Passwordfields, type the default admin and root passwords, and then type a new password in thePasswordandConfirm Passwordfields.
- Click theNextbutton at the bottom of the screen.The screen Summary displays the details you just specified for this device configuration.
- If the details are as you intended, clickLaunchto continue; if you want to make corrections, use thePreviousbutton to navigate back to the screen you want to change.
Manual license and initial setup for a DCD
If the BIG-IQ system is not connected to the
public internet, you can follow these steps to contact the F5 license web portal then
perform the initial setup.
- Use a browser to log in to BIG-IQ by typinghttps://, where<management_IP_address><management_IP_address>is the address you specified for device management.
- ClickNext.If you are setting up this device for the first time, the Accept User Legal Agreement screen opens.
- To accept the license agreement, selectI have read and agree to the terms of this license, and clickNext.The licensing server creates the license key text.
- Copy the license key.
- In theLicense Textfield on BIG-IQ, paste the license text.
- Click theActivate Licensebutton.
- Click theNextbutton at the bottom of the screen.If your license supports both BIG-IQ Data Collection Device and BIG-IQ Central Management Console, the System Personality screen displays. Otherwise the Management Address screen opens.
- If you are prompted with the System Personality screen, select the option you're licensed for, and then clickOK. If you are not prompted, proceed to the next step.You cannot undo this choice. Once you license a device as a BIG-IQ Management Console, you can't change your mind and license it as a Data Collection Device.The Management Address screen opens.
- In theHostnamefield, type a fully-qualified domain name (FQDN) for the system.The FQDN can consist of letters and numbers, as well as the characters underscore ( _ ), dash ( - ), or period ( . ).
- In theManagement Port IP AddressandManagement Port Routefields, type the IP address for the management port IP address and route.The management port IP address must be in Classless Inter-Domain Routing (CIDR) format. For example:10.10.10.10/24.
- Specify what you want the DCD to use for theDiscovery Address.The DCD advertises this address to other devices that want to communicate with it. DCD nodes communicate using their respective discovery addresses.
- To use the management IP address, selectUse Management Address.
- To use the internal self IP address, selectSelf IP Address, and type the IP address.F5 strongly recommends using the internal self IP address as the Discovery Address for a DCD.The self IP address must be in Classless Inter-Domain Routing (CIDR) format. For example:10.10.10.10/24.
- Click theNextbutton at the bottom of the screen.The Services screen opens.
- In theDNS Lookup Serversfield, type the IP address of your DNS server.You can click theTest Connectionbutton to verify that BIG-IQ can reach that IP address.
- In theDNS Search Domainsfield, type the name of your search domain.The DNS search domain list allows the BIG-IQ system to search for local domain lookups to resolve local host names.
- In theTime Serversfield, type the IP addresses of your Network Time Protocol (NTP) server.You can click theTest Connectionbutton to verify that BIG-IQ can reach the IP address.
- From theTime Zonelist, select your local time zone.
- Click theNextbutton at the bottom of the screen.The Master Key screen opens.
- For thePassphrase, type a phrase that satisfies the requirements specified on screen, and then type the same phrase forConfirm Passphrase.The DCD uses the pass phrase to generate a Master Key. This pass phrase must be the same on all of the devices in the DCD cluster. Make sure you keep track of the pass phrase, because it cannot be recovered if you lose it
- Click theNextbutton at the bottom of the screen.The Password screen opens.If you are setting up a Microsoft Azure VE, and you type an entry in any of the fields, you will not be able to continue successfully. The only way to proceed is to leave all of the fields empty and click theNextbutton at the bottom of the screen. This allows the system to use the first-time access credentials you specified previously.
- In theOld Passwordfields, type the default admin and root passwords, and then type a new password in thePasswordandConfirm Passwordfields.
- Click theNextbutton at the bottom of the screen.The screen Summary displays the details you just specified for this device configuration.
- If the details are as you intended, clickLaunchto continue; if you want to make corrections, use thePreviousbutton to navigate back to the screen you want to change.
Discover and activate a data collection
device
Using BIG-IQ
Centralized Management, you can discover a data collection device (DCD) and add it to
the Logging Group, where the BIG-IQ system can access its data. You can then receive
data from multiple BIG-IP systems. This unified view makes
browsing easier, and provides a complete view of application alert or event activity and
statistics data.
- At the top of the screen, clickSystem, then, on the left, click .The BIG-IQ Data Collection Devices screen opens to list the data collection devices in the cluster.
- ClickAdd.
- On the New BIG-IQ Data Collection Device screen, specify the details for this DCD:
- InDiscovery/Listener Address, type one of the self IP addresses for this DCD.The BIG-IQ system uses this address to discover the DCD. The DCD uses this address to listen for alerts from your managed devices.
- InUsername, type the user name for an administrator on the data collection device (for example,admin).
- InPassword, type the password for an administrator on the data collection device (for example,admin).
- InData Collection IP Address, type one of the self IP addresses for this DCD.The DCD uses this address to exchange data and replicas with other DCDs in the cluster.The DCD and BIG-IQ should both use the same VLAN.
- Note theData Collection Portvalue (9300). This field displays the number of the port that DCDs in your cluster use for internal polling and communication with each other.You cannot change the port, but knowing the port number may be useful in resolving DCD communications issues.
- ForZone, either select the disaster recovery zone in which you want this DCD to reside, or use the default setting.
- If your organization does not use disaster recovery zones, usedefault.
- If disaster recovery zones have been created, select the zone for this device and clickUpdate.
- If you want to create a disaster recovery zone:
- SelectCreate New. A new text box opens.
- Type the name for the new zone in text box, and clickUpdate.
You set up the zones so that the BIG-IQ devices and DCDs in your cluster are distributed equitably for disaster recovery purposes.When you change the setting for theZone, the DCD cluster restarts. Data collection is interrupted until the service resumes. - Click theAddbutton at the bottom of the screen to add the data collection device to the system.This operation might take a minute or two.
- Repeat the preceding steps for each data collection device you want to configure.
- To activate the services you want to monitor on each DCD, on the BIG-IQ Data Collection Devices screen, in the Services column, clickAdd Services.The Services screen for the data collection device opens.
- For the service you want to add, confirm that theListener Addressspecifies the correct self IP address on the data collection device, and then clickActivate.When the service is successfully added, theService Statuschanges toActive.
- ClickSave & Close.
After it has been discovered and
activated, this data collection device collects the data generated by the configured
BIG-IP systems. Thus, BIG-IQ provides a single view of all alert or event entries and
statistics data.
The
Total Document Count
is not a report of the number of
alerts or events sent to the data collection device. Instead, it is a sum of various
document types sent to the data collection device. Events and alerts are included in
this list, but this total includes other document types as well. Configure secure communications for data
collection device
You need a signed SSL certificate
before you can configure HTTPS communications to a data collection device.
If you want to secure the
communications between the BIG-IP devices and your data collection
device cluster using SSL encryption, you must provide a signed SSL certificate to the
BIG-IP devices and F5
BIG-IQ Centralized Management systems. You do this by configuring
both the BIG-IP device and the data collection device.
The BIG-IP device that generates
Fraud Protection Service alerts must be configured to send its alerts to the data
collection device (DCD). This process is documented in a separate guide. The guide
F5 Fraud Protection Service: Configuration, Version 13.0
provides
complete setup instructions for using FPS on a BIG-IP system. Complete the standard
setup as documented in the guide, except when you configure the alert server pool,
add your DCDs to an alerts pool using their internal self IP
addresses.- Use SSH to log in to the data collection device.
- Replace the content of the/etc/httpd/conf/ssl.crt/directory on the data collection device with your signed SSL certificate.
- Replace the content of the/etc/httpd/conf/ssl.key/directory on the data collection device with your signed SSL key.
- To apply these changes to the data collection device, type:bigstart restart webdand then press Enter.
- Log out of the data collection device.
Add a proxy for secure
communication
Before you can perform this task, you must be logged in as Admin,
and you must have configured a proxy server that your data collection device (DCD)
cluster can access.
As a security precaution, you may want to
configure a proxy to route communications. For example you might use it to route your
forwarded alerts or download alert rules from the security operations center. Or you
might want to use a proxy to avoid exposing the DCD when you download ASM signature
files.
To use a proxy for Fraud Protection Service, you must
configure a proxy on each device (every DCD and both the primary and the secondary
BIG-IQ devices) in the cluster. The proxy names you specify for each node in the
cluster must match exactly, but the IP address and port number for the proxy can be
different from device to device.
- At the top of the screen, clickSystem.
- On the left, clickPROXIES.
- On the Proxies screen, clickAdd.
- ForName, type a name for the proxy you want to use.The proxy name must match across all devices in the cluster. The proxy addresses and port can vary.
- ForAddress, type the IP address of the proxy server.
- ForPort, type the port that you want the proxy server to use.
- If the proxy server requires authentication, type theUser NameandPasswordfor the proxy.
- To add another proxy, click the plus sign in the upper right hand corner, and then repeat the preceding 4 steps.
- ClickSave & Close
You need to add a proxy for each data collection device in the cluster.
Remember, the proxy name must match across all devices in the cluster.
The proxy addresses and port can vary.
Manage the
retention policy for your statistics data
Before you can set the statistics retention policy, you must have added a data
collection device.
You can manage the settings that determine how
your statistics data is retained. The highest quality data is the raw data, (data that
has not been averaged), but that consumes a lot of disk space, so you need to consider
your needs in choosing your data retention settings. When you choose how much raw data
to retain, you need to consider how much disk space you have available. The controls on
this screen are simple to set up, but understanding how they work takes a bit of
explanation.
The fields on the Statistics Retention Policy screen
all work in similar fashion. One way to understand how these fields work is to think
of your data storage space as a set of containers. The values you specify on this
screen determine how much storage space each container consumes. Because data is
saved for the time periods you specify, the longer the time period that you specify,
the more space you consume. The disk storage that is consumed depends on several
factors.
- The number of BIG-IP devices you manage
- The number of objects on the BIG-IP devices you manage (for example, virtual servers, pools, pool members, and iRules)
- The frequency of statistics collection
- The data retention policy
- The data replication policy
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The Statistics Collection Status screen opens.
- On the left, clickStatistics Data Collection.The Statistics Collection Status screen displays the percentage of available disk space currently consumed by statistics data for each container.
- To change the retention settings for your statistics data, clickConfigure.The Statistics Retention Policy screen opens.
- In theKeep real-time (raw) data up tofield, type the number of hours of raw data to retain.You must specify a minimum of 1 hour, so that there is sufficient data to average and create a data point for theKeep hourly data up tocontainer.
- In theKeep hourly data up tofield, type the number of hourly data points to retain.You must specify a minimum of 24 hours, so that there is sufficient data to average and create a data point for theKeep daily data up tocontainer.
- In theKeep daily data up tofield, type the number of daily data points to retain.You must specify a minimum of 31 days, so that there is sufficient data to average and create a data point for theKeep monthly data up tocontainer.
- In theKeep monthly data up tofield, type the number of monthly data points to retain.Once the specified number of months passes, the oldest monthly data set is deleted.
- In theLimit max storage tofield, type the percentage of disk space that you want collected data to consume before the oldest monthly data set is deleted.
- Expand Advanced Settings, and then select theEnable Replicascheck box.Replicasare copies of a data set that are available to the DCD cluster when one or more devices within that cluster become unavailable. By default, data replication for statistics is not enabled. Disabling replication reduces the amount of disk space required for data retention. However, this provides no protection from data corruption that can occur when you remove a data collection device. You should enable replicas to provide this protection.
- When you are satisfied with the values specified for data retention, clickSave & Close.
Decide whether to configure log indices
The Indices settings specify the physical characteristics of how the data collection device
manages your data. The DCD stores data coming in from BIG-IP® devices in a
data index. As data is received, it accumulates in the current index. When the accumulated data
reaches the rotation threshold that you set, four things happen.
- A new current index is created.
- BIG-IP data begins accumulating in the new index.
- The former current index becomes one of the retained indices.
- If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
The ideal configuration for log
indices depends on the flow of data your devices send to the DCD. The default settings are
designed to satisfy most user scenarios, but you might want to explore the settings for the data
types that you plan to send to the DCD, to make sure that those settings meet your
needs.
Modify alert log indices for
Access
Before you can configure the indices for a data collection device, you must activate
services for the components that you want to collect data for.
The
Indices
settings specify the physical characteristics of how the data collection device manages
your data. The DCD stores data coming in from BIG-IP devices in a data index. As data is
received, it accumulates in the current index. When the accumulated data reaches the
rotation threshold you set, four things happen.- A new current index is created.
- BIG-IP data begins accumulating in the new index.
- The former current index becomes one of the retained indices.
- If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
The ideal log indices configuration depends on the flow of
data your devices send to the DCD. Use the rotation type that best suits your
business needs.
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The Logging Data Collection Settings screen opens.
- For Access Policy (APM), click theConfigurebutton.The Access Indices screen opens.
- Perform the next two steps for each section on this screen.To avoid a mismatch in the reports generated from your logging data, use the same indices values for theaccess-event-logsandaccess stats.
- Specify theRotation Type.
- To chunk your data based on the amount of data:
- SelectSize Based
- For theMax Index Size, type the size of the indexes you want to create.
For example, if you type1000, when the index size reaches 1 GB, it becomes a retained index and new data from your BIG-IP begins accumulating in a new current index. If yourRetained Index Countis set to 10, then the maximum disk space used by these indexes will be approximately 10 GB. - To chunk your data based on the increments of time:
- Select Time Based
- For theRotation Period, specify a time unit, and type how many of those units you want to comprise indexes you want to create.
For example, if you type.5and selectHours, a new index is created every half hour. If yourRetained Index Countis set to 10, then each retained index will contain approximately 5 hours of data.
- For theRetained Index Count, type the total number of indices you want to store on the DCD.This setting determines the maximum amount of data stored on the DCD. When this limit is reached, the oldest data is truncated or discarded. For example, if you set the number of indices to 10 and each index is 1 GB, then you must have 10 GB of storage available on your DCD.
- ClickSave & Closeto save the indices configuration settings.
Modifying event log indices for
FPS
Before you can configure the indices for a data collection device, you must activate
services for the components that you want to collect data for.
The
Indices
settings specify the physical characteristics of how the data collection device manages
your data. The DCD stores data coming in from BIG-IP devices in a data index. As data is
received, it accumulates in the current index. When the accumulated data reaches the
rotation threshold you set, four things happen.- A new current index is created.
- BIG-IP data begins accumulating in the new index.
- The former current index becomes one of the retained indices.
- If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
The ideal log indices configuration depends on the flow of
data your devices send to the DCD. Use the rotation type that best suits your
business needs.
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The Logging Data Collection Settings screen opens.
- For Fraud Protection (FPS), click theConfigurebutton.The FPS Indices screen opens.
- Specify theRotation Type.
- To chunk your data based on the amount of data:
- SelectSize Based
- For theMax Index Size, type the size of the indexes you want to create.
For example, if you type1000, when the index size reaches 1 GB, it becomes a retained index and new data from your BIG-IP begins accumulating in a new current index. If yourRetained Index Countis set to 10, then the maximum disk space used by these indexes will be approximately 10 GB. - To chunk your data based on the increments of time:
- Select Time Based
- For theRotation Period, specify a time unit, and type how many of those units you want to comprise indexes you want to create.
For example, if you type.5and selectHours, a new index is created every half hour. If yourRetained Index Countis set to 10, then each retained index will contain approximately 5 hours of data.
- For theRetained Index Count, type the total number of indices you want to store on the DCD.This setting determines the maximum amount of data stored on the DCD. When this limit is reached, the oldest data is truncated or discarded. For example, if you set the number of indices to 10 and each index is 1 GB, then you must have 10 GB of storage available on your DCD.
- ClickSave & Closeto save the indices configuration settings.
Modify alert log
indices for Web Application Security
Before you can configure the indices for a data collection device, you must activate
the services for the components that you want to collect data for.
The
Indices
settings specify the physical characteristics of how the data collection device manages
your data. The DCD stores data coming in from BIG-IP devices in a data index. As data is
received, it accumulates in the current index. When the accumulated data reaches the
rotation threshold you set, four things happen.- A new current index is created.
- BIG-IP data begins accumulating in the new index.
- The former current index becomes one of the retained indices.
- If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
The ideal log indices configuration depends on the flow of
data your devices send to the DCD. Use the rotation type that best suits your
business needs.
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The Logging Data Collection Settings screen opens.
- For Web Application Security (ASM), click theConfigurebutton.The ASM Indices screen opens.
- Specify theRotation Type.
- To chunk your data based on the amount of data:
- SelectSize Based
- For theMax Index Size, type the size of the indexes you want to create.
For example, if you type1000, when the index size reaches 1 GB, it becomes a retained index and new data from your BIG-IP begins accumulating in a new current index. If yourRetained Index Countis set to 10, then the maximum disk space used by these indexes will be approximately 10 GB. - To chunk your data based on the increments of time:
- Select Time Based
- For theRotation Period, specify a time unit, and type how many of those units you want to comprise indexes you want to create.
For example, if you type.5and selectHours, a new index is created every half hour. If yourRetained Index Countis set to 10, then each retained index will contain approximately 5 hours of data.
- For theRetained Index Count, type the total number of indices you want to store on the DCD.This setting determines the maximum amount of data stored on the DCD. When this limit is reached, the oldest data is truncated or discarded. For example, if you set the number of indices to 10 and each index is 1 GB, then you must have 10 GB of storage available on your DCD.
- ClickSave & Closeto save the indices configuration settings.
Modifying alert log indices for
IPsec
Before you can configure the indices
for a data collection device, you must activate services for the components that you
want to collect data for.
The
Indices
settings specify the physical characteristics of how the data collection device manages
your data. The DCD stores data coming in from BIG-IP devices in a data index. As data is
received, it accumulates in the current index. When the accumulated data reaches the
rotation threshold you set, four things happen.- A new current index is created.
- BIG-IP data begins accumulating in the new index.
- The former current index becomes one of the retained indices.
- If the total number of indexes is now larger than the retained index count, the oldest one is dropped.
The ideal log indices configuration depends on the flow of
data your devices send to the DCD. Use the rotation type that best suits your
business needs.
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The Logging Data Collection Settings screen opens.
- For Fraud Protection (FPS), click theConfigurebutton.The FPS Indices screen opens.
- Specify theRotation Type.
- To chunk your data based on the amount of data:
- SelectSize Based
- For theMax Index Size, type the size of the indexes you want to create.
For example, if you type1000, when the index size reaches 1 GB, it becomes a retained index and new data from your BIG-IP begins accumulating in a new current index. If yourRetained Index Countis set to 10, then the maximum disk space used by these indexes will be approximately 10 GB. - To chunk your data based on the increments of time:
- Select Time Based
- For theRotation Period, specify a time unit, and type how many of those units you want to comprise indexes you want to create.
For example, if you type.5and selectHours, a new index is created every half hour. If yourRetained Index Countis set to 10, then each retained index will contain approximately 5 hours of data.
- For theRetained Index Count, type the total number of indices you want to store on the DCD.This setting determines the maximum amount of data stored on the DCD. When this limit is reached, the oldest data is truncated or discarded. For example, if you set the number of indices to 10 and each index is 1 GB, then you must have 10 GB of storage available on your DCD.
- ClickSave & Closeto save the indices configuration settings.
DCD snapshot overview
With snapshots of the data sent to your data collection devices (DCDs) you can preserve the logging and analytics information stored on your DCD cluster at a
particular moment in time. Snapshots are created based on the snapshot schedules that you
define. The primary use is to restore older versions of your data when you upgrade your BIG-IQ
cluster. Although each snapshot only contains changes since the last snapshot was created, if
your BIG-IP devices are adding data at a high rate, the snapshots can get quite large. Despite
their incremental nature, there are no dependencies or relationships between snapshots that are
taken at specific times. Unlike typical incremental restorations, there is no need to restore
multiple snapshots to recover data.
Because the underlying Elastic Search (ES) cluster already replicates both
event logs and analytics data across the entire DCD cluster, you don't need snapshots to
prevent loss of data, except in the case of catastrophic failure. If a single DCD fails, the
data is still available due to the replication that occurs across all DCDs in the cluster. If
you had a major failure (multiple DCDs), you can use a snapshot to restore the entire cluster
to a point in time.
You control the snapshot frequency using the Backup Schedule screen. Each organization
determines their own recovery point objective (RPO) as part of their disaster recovery plan.
Because the snapshot represents a point-in-time copy of the data in the ES cluster, you should align your
snapshot schedule with your RPO. Take into account the amount of time or tolerance that your
organization has for data loss. For example, if your RPO is 12 hours, then snapshots would be
scheduled to occur every 12 hours. If all of the DCDs in your cluster failed 11 hours after
the last successful snapshot, then you would lose any data collected after that snapshot. If
this is not acceptable, you can schedule more frequent snapshots, but those extra backups
require more storage. You can also mitigate that cost to some extent by carefully configuring
your data retention settings.
On the External Storage & Snapshots screen, you can restore from the
last known good snapshot. However, you cannot restore from previous snapshots. Use the
External Storage & Snapshots screen to perform all DCD snapshot management. This ensures
that your snapshot data is kept consistent, and that records are updated accordingly.
Before you proceed, keep in mind that there are several different ways to make backups of
your data. Each of these methods backs up different things and is documented separately.
- DCD snapshots (discussed here) back up the alert, event, and analytics data collected by your DCDs.
- Configuration snapshots back up the settings for configuration objects that reside on your managed BIG-IP devices. Refer toManaging Configuration Snapshotsin theBIG-IQ Centralized Management: Devicearticle onsupport.f5.comfor details.
- To back up the configuration of a BIG-IQ system, you create a compressed user configuration set (UCS). Refer toBIG-IQ System File Managementin thePlanning and Implementing a BIG-IQ Centralized Management Deploymentarticle onsupport.f5.comfor details.
- You also use a UCS file to back up the configuration of a managed BIG-IP device. Refer toBackup File Managementin theBIG-IQ Centralized Management: Devicearticle onsupport.f5.comfor details.
Define snapshot schedules
Before you define snapshot schedules, you must
have defined the snapshot storage location.
You create snapshots of the data sent to your data
collection devices (DCDs) to preserve the logging and analytics information stored on
your DCD cluster at a particular moment in time. You control how frequently the BIG-IQ
creates snapshots, based on your organization's unique business requirements. For a more
detailed discussion of factors to consider when determining your schedule, refer to
DCD snapshot overview
in the Planning and Implementing a BIG-IQ Centralized Management
Deployment
article on support.f5.com
. You perform this task on the BIG-IQ Centralized
Management device; not on the data collection device (DCD).
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The External Storage & Snapshots screen opens so you can specify how you want to schedule snapshots.
- To view the list of snapshot schedules for this device, in the External Storage & Snapshots area, forSnapshot Schedulesclick theView Schedulesbutton.The BIG-IQ Data Collection Snapshot Schedule screen opens.
- To define a new snapshot schedule for this device, clickCreate.The New BIG-IQ Data Collection Snapshot Schedule screen opens.
- For theSnapshot Name Prefix, type the string that you want to use to identify the snapshots created by this schedule.For example,snapshot_.
- InSnapshots to Keep, specify the number of snapshots that you want to accumulate before they are deleted for space constraints.For example, if you specify25, then the system will retain a maximum of 25 snapshots before it starts to delete older snapshots as new snapshots are created. You can save up to 100.
- Define how you want the snapshots scheduled.Schedule the interval at which you want to create snapshots:You schedule the system to take snapshots indefinitely, at the frequency you specify.
- For the Schedule Type setting,selectRepeat Interval.
- Specify theSnapshot Frequency.
- Select a time increment.
For example, if you set the frequency to6andHours, the first DCD snapshot is taken immediately (onSave & Close). Subsequent snapshots are taken every 6 hours.Schedule specific days on which you want to create snapshots:You schedule the system to take snapshots on specific days.- For the Schedule Type setting, selectDays of the Week.
- For theDays of the Weeksetting, select the days on which you want backups to occur.
- For theStart Date, select the time (date, hour, minute, and AM or PM) on which you want backups to start.
- ClickSave & Closeto save the new schedule.
Define external storage snapshots
location
Before you configure the external
snapshot storage location, collect the following information for the machine that will
store your data collection device (DCD) snapshots:
- IP address for the storage machine
- Storage file path
- User name, password, and (optionally) domain for the user account configured on the external storage device
- Read/Write permissions for the storage file path
You need snapshots to perform software upgrades and to restore your old data.
Creating external storage so you can create snapshots is an optional
task. However, F5 strongly recommends that you create snapshots to safeguard
your data.
If you set up external storage for this logging node cluster in
5.1.and plan to retain that setup after you upgrade, continue setting up the
external storage location. When you create DCD snapshots, they need to be stored on
a machine other than the DCD. You define the location for the snapshot using the
BIG-IQ Centralized Management device.
- At the top of the screen, clickSystem, then, on the left, clickBIG-IQ DATA COLLECTIONand then selectBIG-IQ Data Collection Cluster.The BIG-IQ Data Collection Cluster screen opens. On this screen, you can either view summary status for the data collection device cluster or access the screens that you can use to configure the DCD cluster.
- Under SUMMARY, you can view information detailing how much data is stored, as well as how the data is stored.
- Under CONFIGURATION, you can access the screens that control DCD cluster performance.
- Under the screen name, click.The External Storage & Snapshots screen opens so you can specify how you want to schedule snapshots.
- ForExternal Storage, clickConfigure.The External Storage popup screen opens.
- In theUser nameandPasswordfields, type the user name and password for the user account configured on the external storage device.
- For theDomain, you can type the domain name for the user account configured on the external storage device.
- For theStorage Path, type the path to the external storage location.You can specify the device using the IP address or the host name. Additionally, you need to specify the path to the folder on the external storage device. For example://<storage machine ip-address>/<storage-file-path>Remember, the folder you specify must have full read, write, and execute permissions.
- To test the settings just specified, clickTest.A message displays to tell you whether the test completes successfully. If it does not, correct the settings and permissions.
- When the external storage is specified successfully, clickSave.
The storage location is accessible to
the all of the devices in the DCD cluster.
Overview of configuring the data
collection device to BIG-IP device connection
The workflow to configure data to route from the BIG-IP® devices to
your data collection device (DCD) cluster depends on the type of data you want to
collect.
- To collect statistics data, refer toDiscover and activate a data collection device.
- To collect Access Policy Manager® data, refer toConfiguring remote logging for Access Policy Manager.
- To collect Fraud Protection Services data, refer toConfiguring BIG-IP FPS devices to route alerts to a data collection device.
- To collect Web Application Security data, refer to:
- Configuring the BIG-IP logging profile
- Virtual servers that remote logging uses to route event logs
- Assigning the logging profile to a virtual server
Configure remote logging for Access Policy
Manager
BIG-IP devices
that you configure for remote logging send Access reporting and SWG log report data to
the BIG-IQ data collection device for storage and
management.
- At the top left of the screen, click.
- ClickRemote Logging Configuration.The Remote Logging Configuration screen opens to display all of the discovered BIG-IP devices that are provisioned with the Access service.
- Select the BIG-IP devices for which you want to enable remote logging, and then clickConfigure.The hostname of the primary data collection device is displayed, and the status changes to let you know whether the enable request was successful.
Configuring BIG-IP FPS devices to route
alerts to a data collection device
The BIG-IP® device that generates Fraud Protection Service alerts must
be configured to send its alerts to the data collection device (DCD). This process is
documented in a separate guide. The guide
F5 Fraud Protection
Service: Configuration, Version 13.0
provides complete setup instructions for using
FPS on a BIG-IP® system. Complete the standard setup as documented in the
guide, except when you configure the alert server pool, add your DCDs to an alerts pool using
their internal self IP addresses.Although DCDs use their own
version of load balancing to level the data stored on each node, it is best practice to
configure the BIG-IP pool members with a load balancing method that ensures smooth traffic
flow to the DCDs. The load balancing method you configure should:
- Distribute traffic between the nodes.
- Ensure that, if a DCD goes offline, the BIG-IP device must still be able send traffic to the available DCDs without dropping alerts.
The default port to specify is
8008
, but you can use a different port
if your DCD is configured for it. To ensure that alerts are received even if one DCD goes
down, specify at least one alternative DCD.Configure the BIG-IP logging
profile
For Web Application Security users,
this is the first of three tasks required to route the BIG-IP
event logs to a BIG-IQ data collection device. You configure the
BIG-IP system by creating a logging profile and assigning the logging profile to a
virtual server, and then deploying it to the BIG-IP system. The
logging
profile
defines the content of the events, and identifies the data collection
device to which the events are sent.- At the top of the screen, clickConfiguration.
- On the left, click.The Logging Profiles screen opens to display the logging profiles that have been configured on this device.
- On the Logging Profiles screen, clickCreate.The New Logging Profile screen opens, showing the Properties information.
- On the Properties screen, edit as appropriate:
- In theNamefield, type a unique name for this new profile. This field is required.
- For theDescription, you can specify an optional description for the logging profile.
- For thePartition, you can specify the partition to which the logging profile belongs. Only users with access to a partition can view the objects (such as the logging profile) that it contains. If the logging profile resides in theCommonpartition, all users can access it. Although this field is pre-populated withCommonby default, you can set the partition when creating logging profiles by typing a unique name for the partition.The partition with the name you specify must already exist on the BIG-IP device. No whitespace is allowed in the partition name.
- To specify the devices to which you want to deploy this logging profile, select the devices in theAvailablelist, and click the right arrow to add them to theSelectedlist.
- On the left, clickApplication Security, and then select theEnabledcheck box.The screen displays the Application Security settings.
- Select theRemote StorageEnabledcheck box.The screen displays additional settings, and theLocal Storageoption becomes active.
- Clear theLocal Storagecheck box.
- Specify the appropriateLogging Format.
- If the BIG-IP device runs version 12.0 or later, selectBIG-IQ.
- If the BIG-IP device runs a version earlier than 12.0, selectComma-Separated Values. Several new settings appear.
- ForStorage Format, selectUser Defined.
- In theSelectedfield, paste the following text:unit_hostname="%unit_hostname%",management_ip_address="%management_ip_address%", http_class_name="%http_class_name%",web_application_name="%http_class_name%",policy_name="%policy_name%", policy_apply_date="%policy_apply_date%",violations="%violations%",support_id="%support_id%", request_status="%request_status%",response_code="%response_code%",ip_client="%ip_client%", route_domain="%route_domain%",method="%method%",protocol="%protocol%",query_string="%query_string%", x_forwarded_for_header_value="%x_forwarded_for_header_value%",sig_ids="%sig_ids%",sig_names="%sig_names%", date_time="%date_time%",severity="%severity%",attack_type="%attack_type%",geo_location="%geo_location%", ip_address_intelligence="%ip_address_intelligence%",username="%username%",session_id="%session_id%", src_port="%src_port%",dest_port="%dest_port%",dest_ip="%dest_ip%",sub_violations="%sub_violations%", virus_name="%virus_name%",uri="%uri%",request="%request%",violation_details="%violation_details%", header="%headers%",response="%response%The line breaks in the example above were necessary due to screen width; remove all of them after you paste this data. It must be a single string with no white space.
- ForProtocol, selectTCP.
- For theServer Addressessettings, specify the address you want to use:
- In theIP Addressfield, type the data collection node's management IP address.
- Specify the port to use for your data.
- If you are setting up a logging profile for Web Application Security, type8514in thePortfield.
- If you are setting up a logging profile for Fraud Protection Service, type8008in thePortfield.
- Click theAddbutton to add the address and port to the list of servers.
- For theMaximum Entry Length, select64k.
- In the Storage Filter area, from theRequest Typelist, selectAll requests.
- If you want to specify Protocol Security options, on the left clickProtocol Security, then select theEnabledcheck box: the Protocol Security settings display. Edit as appropriate.
- If you want to specify Network Firewall options, on the left clickNetwork Firewall, then select theEnabledcheck box: the Network Firewall settings display. Edit as appropriate.
- If you want to specify Network Address Translation options, on the left clickNetwork Address Translation, then select theEnabledcheck box: the Network Address Translation settings display. Edit as appropriate.
- If you want to specify DoS Protection options, on the left clickDoS Protection, then select theEnabledcheck box: the DoS Protection settings display. Edit as appropriate.
- ClickSave & Closeto save the new profile.
The new logging profile is added to
the list of profiles defined on this device.
Before you can begin using this
profile, you must assign it to a virtual server and then deploy the virtual server to
the BIG-IP device.
Virtual servers that remote logging uses to
route alert or event logs
You can either create a new virtual server on the BIG-IP® device that
creates the alert or event, or you can use a virtual server that already exists on that
device.
Creating a virtual server for remote logging
If the device for which you are configuring remote logging does not have a virtual
server, you need to create one.
- At the top of the screen, clickConfiguration.
- On the left, expandLOCAL TRAFFIC.
- UnderLOCAL TRAFFIC, selectVirtual Servers.The screen displays a list of virtual servers defined on this device.
- ClickCreate.The Virtual Servers - New Item screen opens.
- In theNamefield, type in a name for the virtual server you are creating.
- From theDevicelist, select the device on which to create the virtual server.
- In theDescriptionfield, type in a brief description for the virtual server you are creating.
- For theDestination Address, type the IP address of the destination you want to add to the Destination list.The format for an IPv4 address isI<a>.I<b>.I<c>.I<d>. For example,172.16.254.1.For example,The format for an IPv6 address isI<a>:I<b>:I<c>:I<d>:I<e>:I<f>:I<g>:I<h>..2001:db8:85a3:8d3:1319:8a2e:370:7348.
- In theService Portfield, type a service port number, or select a type from the list.When you select a type from the list, the value in theService Portfield changes to reflect the associated default, which you can change.
- ClickSave.The system creates the new virtual server with the settings you specified.
- ClickSaveto save the assignment. Or, clickSave & Closeto save the assignment and return to the Virtual Servers screen.
A virtual server that can be used to
route alert or event data to the logging node is created for the BIG-IP device.
Before the BIG-IP device can actually use this new virtual server, you must deploy
it to the device.
Assign the logging profile to a virtual
server
After configuring a logging profile
on the BIG-IQ system, you must assign it to a virtual server and
deploy it to the BIG-IP device from which you want to collect
event logs.
- At the top of the screen, clickConfiguration.
- On the left, click.The screen displays a list of virtual servers that are configured with devices that have been provisioned and discovered.
- On the Virtual Servers screen, click the name of the virtual server you want to use.The Virtual Servers - Properties screen opens.
- From theLog Profileslist, underAvailable, click a logging profile and move it to theSelectedlist.
- ClickSave & Closeto save the assignment and return to the Virtual Servers screen.
The virtual server is now associated
with the logging profile.
Before the BIG-IP system(s) can
start sending alert or event logs to the data collection device, you must deploy the
changes you just made to the BIG-IP device.