Install Guide
Overview
This app collects the web access logs and NetApp logs of Somansa WebKeeper SG into Logpresso Sonar. Two collection methods are available. Choose the one that fits your environment.
| Method | Logger model | Description |
|---|---|---|
| File (SFTP) | WebKeeper SG (SFTP) | Sonar connects over SFTP and reads the CSV log files exported by WebKeeper |
| Elastic | WebKeeper SG | Sonar reads documents directly from the Elastic indices that WebKeeper SG writes to |
For file collection, the parser the app provides determines the log type, sets the log_type field to http (web) or netapps (NetApp), and normalizes each log to the webkeeper-http or webkeeper-netapps schema.
Scope
Note
Works on Sonar 4.0.2308.0 or later. File (SFTP) collection is supported from app version 1.2.2610.0.
Requirements
| Item | Requirement | Note |
|---|---|---|
| Sonar permission | System administrator permission | Access to Collect > Loggers and System > Connect Profiles |
| File access (file collection) | Read permission on the log file directory | For the SFTP account |
| Network (file collection) | TCP/22 (Sonar collection node → log file host) | Use the changed port if SSH runs on a different port |
| Network (Elastic collection) | Elastic web port (Sonar collection node → Elastic server) | Set the firewall policy so that Logpresso can reach the Elastic web port |
Logpresso Collection Settings
File (SFTP) collection
Step 1: Add an SSH connect profile
The SFTP logger connects to the log file host with an SSH type connect profile. Go to System > Connect Profiles, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the connect profile |
| Required | Identifier | A unique identifier of the connect profile used in Logpresso queries |
| Required | Type | Select SSH |
| Required | Host | IP address or host name of the log file host |
| Required | Port | SSH port. Defaults to 22 |
| Required | Account | Account with read permission on the log file directory |
| Required | Authentication type | Select Auth key or Password |
| Optional | Password | Enter when the authentication type is password |
| Required | Timeout | Connection timeout in seconds. Defaults to 30 |
| Optional | Keep alive | Keep-alive interval in milliseconds |
Note
When the authentication type is set to auth key, check the Sonar SSH public key with the public key setup button next to the authentication type, and register it in the authorized_keys file of the account on the log file host. The connection test fails until the key is registered.
When you finish, run the connection test and make sure it succeeds.
Step 2: Add a logger
Go to Collect > Loggers, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the logger |
| Required | Execution mode | Select Interval |
| Required | Interval | Collection interval in seconds |
| Required | Storage location | Select the node that stores the logs |
| Optional | Collection location | Select the sentry that performs the collection |
| Required | Logger model | Select WebKeeper SG (SFTP) |
| Required | Table | Name of the table that stores the logs. e.g. WEBKEEPER |
| Required | SSH profile | The connect profile registered in step 1 |
| Required | Directory path | Absolute path of the directory that holds the log files |
| Required | File name pattern | Regular expression matching the names of the web and NetApp CSV files |
| Optional | Charset | Character encoding of the log files |
Note
The parser reads the first line (header) of each file to map the columns. You do not need to change the logger settings even if WebKeeper changes the exported columns.
Elastic collection
Step 1: Add a connect profile
Go to System > Connect Profiles, click Add, select Webkeeper SG as the type, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the connect profile |
| Required | Identifier | A unique identifier of the connect profile used in Logpresso queries |
| Required | Type | Select Webkeeper SG |
| Required | Elastic URL | Elastic address (in the form of https://IP) |
| Required | ES indices format | Index creation cycle. Daily yyyyMMdd, weekly yyyyMM_W, monthly yyyy_MM |
Step 2: Add a logger
Go to Collect > Loggers, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the logger |
| Required | Execution mode | Select Interval |
| Required | Interval | Collection interval in seconds |
| Required | Storage location | Select the node that stores the logs |
| Optional | Collection location | Select the sentry that performs the collection |
| Required | Logger model | Select WebKeeper SG |
| Required | Table | Name of the table that stores the logs. e.g. WEBKEEPER |
| Required | Connect profile | Name of the connect profile registered in step 1 |
| Required | Log collection start date | Date from which to collect logs, in yyyyMMdd format |
| Optional | Wait time (seconds) | To prevent duplicate collection, collects only logs older than this time from now. Defaults to 5 |
Verification
Run the following query to confirm that collection works. The table name is the one you entered in the logger. Adjust the time range to how often the log files are created.
- Normal: The record count for each of
httpandnetappsis 1 or more. For Elastic collection, only the total count appears withoutlog_type. - Abnormal: If the count is 0, recheck the connection test of the SSH connect profile, the read permission of the account, the directory path, and the file name pattern. For Elastic collection, check the firewall policy and the index format.
Note
If log_type is empty and the line field still holds the raw line, the parser could not normalize the log. Check in the exported file whether the number of columns in that line differs from the header.