Scheduling a Replay Session

You can schedule a Replay session to run immediately or at a scheduled time in the future.

You can schedule multiple Replay sessions to run from the same source ST appliance, but the destination LX appliance must be different. Replay sessions are serialized and start in sequence.
Warning: When scheduling a replay, if you select Authentication and Encryption options, type the CLI command system keycopy on the ST appliance and follow the instructions displayed on the screen to add the public key to the LX appliance.
Note: The real-time logs can be replayed multiple times. Duplicate logs will not be rejected by LX. However, file-based logs are accepted only once and duplicate logs will be rejected by LX. 
Pulled files are always replayed as a whole file. However, real-time logs can be subjected to filtering.

Procedure

  1. From the navigation menu of the ST appliance, click Administration > Replay.

    The Replay Status tab appears listing all existing Replay sessions in your system.

    If no Replay session has been scheduled yet, the Replay Status tab will display No match found in database even though you may have added a Replay rule (or modified an existing one) and configured the Time Interval—you still must schedule the Replay rule to run in a Replay session.

  2. To schedule a Replay session, click the Schedule Replay button.
    The Schedule Replay tab appears.
  3. In the Schedule Replay tab, enter the following information:
    • Destination—IP address of the destination LX appliance used for the Replay session.
    • Replay Rules—Select the appropriate Replay rule (to add additional rules, click Add Rule).
    • Authentication Required—Select the checkbox to enable authentication between the source ST appliance and the destination LX appliance.
    • Encryption Required—Select the checkbox to require encryption of the data sent from the source ST appliance to the destination LX appliance.
    • Schedule replay to run immediately—Select the checkbox to schedule the Replay session to run immediately upon clicking the Save button.
    • Start Time—Start date and time to run the Replay session.
  4. Click Save.

Result

The Replay Status tab appears with the new scheduled replay session. If you scheduled the Replay session to occur in the future, the State appears as pending.

All completed Replay sessions remain in the Replay Status page showing their state. You can remove a Replay session.