Adding File Transfer Rules
You can add and modify the existing File transfer rules from the Management > Devices > File Transfer Rules tab. The options on both tabs are the same.
Prerequisites
- For using an Amazon S3 file collector, the user must have:
- If the new file transfer rule uses the SFTP or SCP protocol, perform a keycopy to the specified server for the specified user. See system Command.
Procedure
- On the Management > Devices > File Transfer Rules tab, select Device Type and Device, and then click .
- In the Rule Name field, specify a name for the rule.
-
From the
Protocol list, select the protocol type to use to transfer files. The supported protocols include:
For details about protocols, see File Transfer Protocols.
Protocol Notes SCP If you specify a wildcard, ensure that the list of files (list of file names only and not the file sizes) does not exceed 32KB. If the list of files exceeds 32KB, consider combining the files to reduce the size of the list to a single file or fewer files. Depending on the number of files you have, you might want to combine the files into an hourly, daily, or weekly file. For example, if you have a large number of .aud files in your specified file transfer directory, you can run the command tar jcf today.tar.bz2 *.aud to create a single file containing all of the .aud files in the directory. Ensure that you configure your SCP file transfer rule to pick up the combined file; in this example today.tar.bz2. HDFS LogLogic LMI connects to the default HDFS port 9000. Whether using the default or a custom port, ensure that the HDFS cluster is configured to use the same port that LogLogic LMI uses. If a different port is used, change the port in the --hdfs-port parameter in the configuration file /loglogic/conf/fc_hdfs.conf and then restart engine_filecollector. Amazon S3 - You must adhere to the Amazon Bucket Restrictions and the rules for naming buckets.
- Ensure that the correct retention rules for file transfer are set up in LogLogic LMI.
- Enter a valid IP address in the Host IP field while creating the log source. This IP address is used only for indexing purposes, and not for connecting to the log source.
- In the User ID field, type the ID to use when accessing the file transfer log source.
- Depending on the protocol you selected, take the appropriate action:
-
In the
Files field, type the absolute path of the file you want to transfer. For example,
/root/user/LogLogic/IIS/ms_iis_ex030131.txt. Multiple files can be specified using a comma (,) or semicolon (;) as the delimiter for all protocols. For additional information, see the table in
File Transfer Protocols.
Note: The administrator of the remote system must verify that the file path does not include symbolic links. If you cannot specify a file path without symbolic links, then relocate the files to a path that can be specified without symbolic links.
- From the File Format list, select the format of the files to be transferred.
- Click the Test button to check if the connection parameters can be used to successfully retrieve the file without ingesting the data. The File Transfer Test Status window appears. Click Cancel to cancel the running test.
-
In the
Collection Time section, specify the time interval or schedule on which files should be transferred.
Option Description Every Select the number of minutes (in five minute increments) to wait between intervals. Every Select the number of hours to wait between intervals. Daily at Select the hour at which files should be transferred every day. Weekly on Select the day and time at which files should be transferred every week. -
For
Use Advanced Data Duplication Detection, select the appropriate option:
- Click Yes for the appliance to try to detect partial duplication of the newly transferred file.
- Click No for the appliance not to detect partial duplication.
By default, the appliance automatically detects exact duplicates among transferred files. Advanced detection analyzes potential duplicate data between transferred files, even if the files are not identical. (For example, a partial file at the end of a transfer that is repeated in whole at the start of the next transfer.)With or without the advanced data duplication detection, the old file is always replaced with the newly transferred file. However, when duplication (complete or partial) is detected, only the non-duplicated portion of the file is processed.
- Click Yes to Enable the transfer rule or No to disable this rule.
-
Click
Add to add the rule.
After you verify that the rule is displayed on the Management > Devices > FileTransfer Rules tab, you can click Dashboards > Log Source Status to view the transfer as it occurs. This might take several minutes.
- If the protocol you select from the Management > Devices > FileTransfer Rules > Add Rule > Add File Transfer Rule tab requires a public key copy, register your public key on the server from which you transfer files.
Copyright © 2020. Cloud Software Group, Inc. All Rights Reserved.