In this video, which is going to be pretty short, I like to share with you some
options regarding
the 40 analyzer and taking a closer look at the log statistics and also the
used storage space.
And for some of this, we can do it at the Graphical User Interface at the 40
Analyzer and for a few
other options. We're going to use the command line and I'd like to show you
examples of both.
So let's begin at the command line interface at the 40 Analyzer. Now there's
two ways of getting
there. One is we could log into the GUI, click on this icon here to get a
command line interface
prompt. So that is one way or if we want to use a terminal emulator like putty WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
prompt. So that is one way or if we want to use a terminal emulator like putty
or secure CRT,
we could SSH over to the 40 Analyzer and either way we can get the command line
interface.
So for the benefit of readability, I'm going to use a terminal emulator. And
the
terminal emulator I'm going to use is secure CRT. So I'll double click on my
entry I have here
40 40 Analyzer, which is at 192.168.1 to 81. And here is the 40 Analyzer. So
regarding logs
on this device, one thing we can do is we can do a diagnose 40 log D space and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on this device, one thing we can do is we can do a diagnose 40 log D space and
that D is for
40 log Damon and we'll do a question mark. And then we have these options. So
let's start off with
log rate, cell type and log rate. And here we're showing us the last five
seconds, last 30 seconds
and last 60 seconds, the log rate. And that's the receive log rate coming in
from the 40 gate
devices reporting to it. If you want to see the totals, we can do the same
command except instead
of using log rate, we go ahead and specify log rate dash total right here. So I
'm going to copy paste
that in press center and that's showing us the total for the last hour, day and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that in press center and that's showing us the total for the last hour, day and
week. We could
also do the diagnose for a specific administrative domain. So here if we did a
diagnose for like D,
the question mark, then we'll go ahead and put in log vol a DOM space and a
question mark and then
we can specify the name. So we are using the root a DOM. So put that in and
that'll show us
for the root a DOM. So these are based on the individual days and there's the
average 32
megabytes per day. We get also a diagnose 40 log D status press center just to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
megabytes per day. We get also a diagnose 40 log D status press center just to
verify that it's
running. We can also do a four-log D and a question mark here. Let's do the log
rate type, which will
show us the log rate for the individual log types. So let me go ahead and put
that back in press
center. So if we scroll up, I've got some really low numbers here because a lot
of the time my 40
analyzer is not running. So here showing us the last hour, day and week based
on the various log
types, including application control, web filter. And if you want to take a
look at the message
receive rate, there's an option for that as well. So we do a diagnose for the
log D space question
mark, and let's use this option message receive rate and we use this option WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mark, and let's use this option message receive rate and we use this option
here message rate
and press enter and that's showing us the message receive rate over the last
five seconds as well as
last 30 seconds and last 60 seconds. Now some of this information can also be
seen at the GUI. So
we go back to the GUI here and we go to the dashboards on the 40 analyzer and
go to status. Here we
have the log receive monitor, which is going to reflect pretty much the same
information we saw
the command line. If we scroll down, this also has the widget here for the disk
I owe, and it also
has the information for the insert rate versus the receive rate, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has the information for the insert rate versus the receive rate, which
effectively is saying how long
is it taking to take that data coming in and put it into the SQL database. Then
if we scroll down,
we have the log insert lag time and also the receive rate versus the forwarding
rate. Again,
we're not forwarding at the moment. So we're only having the receive rate here.
And then if we scroll
down, we also have this quoted usage as well. So firewall one is using 0.3%.
And then unused,
we have 99.6%, which equates to the pop up here as 49.8 gigs available for
storage. Now also for
settings regarding logging, if we go to system settings and we go to ADOMS, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
settings regarding logging, if we go to system settings and we go to ADOMS, we
can also control
here on an ADOM level, the settings we want to use for the logging. So here for
the root ADOM,
we'll double click on that is showing us here the actual devices that are
reporting to the ADOM,
including branch firewall one, and the headquarters firewall one, two, and
three. And then we have our
data policy, how long to keep the data for analytics, 60 days, and then once
they're archived, how long
to keep them. And the data policy is going to depend quite a bit on the type of
business you're in.
So based on regulations, some companies may be required to keep the logs for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on regulations, some companies may be required to keep the logs for
longer. But generally
speaking, you don't want to keep logs for longer than is needed or required.
Under disk allocation,
showing the allocated space 50 gigs. And based on the virtual machine I'm
running, I've got 327,
I could allocate, but I'm only allocating 50 gigs. And then for archiving, when
it takes the log
information and archives it by default, it's set here to 70%. So we can modify
that we want to,
and say, for example, we want to wait till I guess the 75% before we start arch
iving. And then as far
as the overall storage, alert and delete when usage reaches and by default, it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as the overall storage, alert and delete when usage reaches and by default, it
's set to 90%.
So this is how we can control the data policy and the discolization per
administrative domain.
So if you click on cancel and go to the BR one eight on which we're currently
not using,
we'd have the similar options here as well.