Scheduling a Replay Session

You can schedule a Replay session to run immediately or at a scheduled time in the future.

You can schedule multiple Replay sessions to run from the same source LogLogic ST Appliance, but the destination LogLogic LX Appliance must be different. Replay sessions are serialized and start in sequence.
Warning: When scheduling a replay, if you select Authentication and Encryption options, type the CLI command system keycopy on the LogLogic ST Appliance and follow the instructions displayed on the screen to add the public key to the LogLogic LX Appliance.
Note: The real-time logs can be replayed multiple times. Duplicate logs are not rejected by the LogLogic LX Appliance. However, file-based logs are accepted only once and duplicate logs are rejected by the LogLogic LX Appliance. 
Pulled files are always replayed as a whole file. However, real-time logs can be subjected to filtering.

Procedure

  1. From the navigation menu of the LogLogic ST Appliance, click Administration > Replay.

    The Replay Status tab appears listing all existing Replay sessions in your system.

    If no Replay session has been scheduled yet, the Replay Status tab displays No match found in database even though you may have added a Replay rule (or modified an existing one) and configured the Time Interval—you still must schedule the Replay rule to run in a Replay session.

  2. To schedule a Replay session, click the Schedule Replay button.
    The Schedule Replay tab appears.
  3. In the Schedule Replay tab, enter the following information:
    • Destination—IP address of the destination LogLogic LX Appliance used for the Replay session.
    • Replay Rules—Select the appropriate Replay rule (to add additional rules, click Add Rule).
    • Authentication Required—Select the checkbox to enable authentication between the source LogLogic ST Appliance and the destination LogLogic LX Appliance.
    • Encryption Required—Select the checkbox to require encryption of the data sent from the source LogLogic ST Appliance to the destination LogLogic LX Appliance.
    • Schedule replay to run immediately—Select the checkbox to schedule the Replay session to run immediately upon clicking the Save button.
    • Start Time—Start date and time to run the Replay session.
  4. Click Save.

Result

The Replay Status tab appears with the new scheduled replay session. If you scheduled the Replay session to occur in the future, the State appears as pending.

All completed Replay sessions remain in the Replay Status page showing their state. You can remove a Replay session.