Devices and quarantine
In CSP (Central Syslog) a device is a server or a network device that sends its logs to the subscription. Only the logs of the devices enter the subscription; those of an unknown sender wait in the Quarantine.
How to add a device and configure it is explained in Sending logs to the panel. This page explains how to keep the devices in order over time: the list, the page of each one, the quarantine and the codes.
The list of devices
The Devices tile of the subscription shows at the top the Sending the logs box, with the server and the ports, and below it the list of devices. The count at the top, for example "3 of 10 devices", says how many devices the plan allows.
For each device the list shows:
- the name you gave it and the Model;
- Recognized by: the IP address, the network, the DNS name, the device name or the Esapanel agent. For a DNS name the list also says what it resolves to now;
- Last log: "Last log from
<address>,<when>", or "No log yet". For an agent, "Agent<version>, last heartbeat<when>"; - Time zone and Alert if silent for, which you change right in the row with Save.
Remove takes a device away: its next logs will go to the quarantine, and its place in the limit of the plan becomes free. The logs it already sent stay.
Alert if silent for
Alert if silent for (Never, 15 minutes, 1 hour, 6 hours, 24 hours) sends an email when the device has not sent logs for longer than that time, and another when it starts again. A silent device shows "Silent since …".
Choose it for the devices that send all the time, such as a firewall or a server with the agent: many devices send only when something happens, and would give false alarms. The time when the server of the panel itself was not receiving does not count.
The time zone
Many devices write in their logs the time of their clock without the time zone (syslog RFC 3164). The Time zone of the device, for example Europe/Rome, lets the panel turn that time into the right moment, daylight saving included. Time as it arrives leaves it as it is. A change applies to the next logs.
The page of a device
The name of a device in the list opens its page, with the instructions to configure it already filled in. Here you can:
- change the Name of the device and the Model: the instructions follow the model;
- choose the Profile of the logs (see below);
- see when the last log arrived. Until the first arrives, the page says so and refreshes by itself.
A device authorized from the quarantine has no model yet: choose it here to see the instructions.
The profile of the logs
The Profile of the logs is how the panel reads the logs of the device to recognize the events: sign ins, configuration changes, blocked traffic, VPN. These events feed the Events section of the Analysis, part of the reports and the event alerts.
- Automatic, the normal choice, uses the profile of the model, or recognizes it from the logs.
- Generic text (by words) is for a device that no profile reads: it looks for words such as "login failed" or "denied". Its events do not start alerts.
- None reads nothing.
There are profiles for Linux, Windows, DrayTek Vigor, pfSense / OPNsense, MikroTik, Fortinet, Sophos, SonicWall, Zyxel, WatchGuard, Check Point, Cisco ASA and IOS, Aruba switches, UniFi gateways, Synology and QNAP, and generic profiles for the devices that send CEF / LEEF, key=value or iptables.
Recognize it as …
Some devices, such as the DrayTek Vigor, do not write their name where the panel expects it, and show up with the reverse name of their address. In this case the page proposes Recognize it as followed by the name the device really writes: from then on the device is accepted with that name from any address, even when a backup line changes the address.
An agent
For an agent the page says until when its client certificate is valid: the agent renews it by itself a month before it expires. For an agent already enrolled the page shows the commands that update it without making a new device.
The quarantine
The Quarantine tile collects the logs that reached the ports of the subscription from senders that are not among the devices. The number on the tile says how many senders are waiting. The logs stay a few days, then they are deleted; beyond a daily limit the quarantine only counts them, without keeping them.
The senders are grouped by Address and Device name, with the number of logs and the period. For each one:
| Button | What it does |
|---|---|
| Authorize the address | The sender becomes a device recognized by its address, and its logs in quarantine move into the subscription |
| Authorize the device name | The same, recognized by the name it writes in the logs, from any address |
| Discard | Deletes its logs in quarantine; the next ones come back here |
| Ignore the address / Ignore the name | Its logs are discarded on arrival and only counted, and those in quarantine are deleted |
Before authorizing you can choose the Profile of the sender: Recognize by itself is usually enough. The profile also says where the sender writes its name. If it does not write a name of its own, the panel lets you authorize only the address.
An authorized sender counts among the devices of the plan. If the sender was already a device, for example added meanwhile from the Devices page, authorizing only moves the logs left in quarantine.
Ignored senders
The Ignored senders list shows the ignored senders and how many logs they have sent since. Stop ignoring brings their next logs back to the quarantine.
Ignore only senders you know and do not want, such as a test device: their logs are lost. There is no need to ignore the scanners of the Internet, which the firewall of the server blocks anyway.
When to look at the quarantine
- A device just configured does not show up: its logs are almost always in the quarantine, with an address different from the one you entered. Authorize it from here, or correct the address in the Devices list and remove the wrong one.
- The email of a silent device mentions logs in quarantine: the device has probably changed address.
The codes of the agents and of the links
At the bottom of the Devices page, Codes of the agents and of the links holds the two codes that the instructions of the servers use:
- the code of the agents enrolls agents in the subscription: whoever has it can add a device, within the limit of the plan. Give it only to whoever installs the agent;
- the code of the links is in the links that download the configuration of rsyslog. These links hold no secret, only the name, the address and the port.
Give a New code (for the links, New code for the links) when a code ended up where it should not. The agents already enrolled and the servers already configured keep working; only the commands copied before stop working.
Ports 514 and 6514
When the subscription receives on a dedicated IP address, on the Devices page you can also turn on the standard port 514 (syslog) and 6514 (syslog over TLS), for the devices that do not let you choose the port. The details are in Sending logs to the panel.