General Tab

Field	Description
Originating Email	The email address that the appliance uses for the return address email notifications in alerts and scheduled reports. Note: If this field or any of the SMTP settings field are changed, you must re-synchronize triggers.
Concurrent Login Sessions	Indicates the maximum number of concurrent login sessions allowed for each LogLogic LMI user. After the permitted number of concurrent connections is reached, a message is displayed to the user on the next attempted login. The message indicates that the limit has been reached and requests the user to close one of the active sessions. The default number of concurrent login sessions allowed per user is 100. Note: This value is applicable to all users in the system. For example, setting the value to 10 implies each user in the system can have at the most 10 concurrent sessions. A full application restart is required for the changes to take effect. Follow the system prompts. The limit on concurrent sessions is not applicable to the REST API used for Advanced Features. After reaching the maximum number of concurrent login sessions, or when users abruptly end their login session, you can remove a user session from the Management > Users > User Sessions tab.
Multiline Delimiter	Sets a character string to be used as line delimiter in multiline logs.
Purge stale devices	Enables the option to purge stale devices based on the last time data was received. For more information, see Purge Stale Devices.
Purge Stale Devices Period	Specify the number of days after which stale devices must be purged.
SSH Daemon at Startup	The SSH Daemon provides access to the appliance's Command Line Interface (CLI) from SSH clients. By default, the SSH Daemon is turned on in the appliance. Click the slider to No to disable the SSH Daemon when you reboot the appliance. For details, see Command Line Interface (CLI).
Auto-identify Log Sources	Automatically detects any syslog log sources connected to the appliance. This includes: Multiple log sources sharing the same IP address. LogLogic LMI considers multiple sources using the same IP address as a single host, because LogLogic LMI uses the IP address to uniquely identify them. Log sources whose log data is converted to syslog during collection To view all identified log sources, use Management > Devices. If you do not enable this option, you must manually add the following log sources. Note: If the Auto-identify Log Sources option detects a log source but does not recognize the exact type, the appliance adds it to the Management > Devices list as a general syslog log source. To manually change a general Syslog log source type: In the Management > Devices tab, click the log source name. From the Device Type list, select the specific device type. Click Update. The Type column displays the device type you associated with the auto-identified log source. If you enable Auto-identify Log Sources and you have several thousand devices configured that need to be auto-identified, routing rules and alerts can slow the auto-identify process down.
DNS Resolve All Device Names	Updates the DNS Resolve Flag for multiple devices. Note: If you select No, the Management > Devices > Apply this update to all devices, not just to those on this page check box overrides your General settings No option.
Full Text Indexing	Allows indexing of data. You can set this for your appliances independently. If enabled, all data is indexed. Note: Indexing uses additional storage. To retain the index data, configure rules from Administration > Data Retention Rules.
Allow Disabling of admin Super User	Allows an admin user to disable the admin super user account. For more information, see Managing Users.
UI Verbose Logging	Enables or disables logging detailed error messages on the GUI. The default value is Yes. If you select No, detailed logging is disabled, and a generic message is displayed instead of error or exception details. You can view the detailed information in syslog files by accessing the machine through SSH.
Log parsing for reports	Enable or disables parsing in LogLogic LMI, so that no content is added to the Real Time database-driven reports. The default value is Yes. This feature is only available on LogLogic EVA, LogLogic LX Appliances, and LogLogic MX Appliances, and in effect makes them similar to a LogLogic ST Appliance.
Manage Device	Enables or disables the ability for users to configure or add devices under Management > Devices. This setting overrides the Manage Devices privilege provided to a user or role, except to the admin super user account.
Accept Detail	Allows drill down for the Real Time and Summary detail reports. Note: This option is not available on LogLogic ST Appliances. You must enable this option to view Reports > Network Activity > Accepted Connections > Network Activity > Application Distribution, and detail reports. This might require additional time and storage in downloading these reports.

Originating Email

The email address that the appliance uses for the return address email notifications in alerts and scheduled reports.

Note: If this field or any of the SMTP settings field are changed, you must re-synchronize triggers.

Concurrent Login Sessions

Indicates the maximum number of concurrent login sessions allowed for each LogLogic LMI user. After the permitted number of concurrent connections is reached, a message is displayed to the user on the next attempted login. The message indicates that the limit has been reached and requests the user to close one of the active sessions.

The default number of concurrent login sessions allowed per user is 100.

Note:

This value is applicable to all users in the system. For example, setting the value to 10 implies each user in the system can have at the most 10 concurrent sessions.
A full application restart is required for the changes to take effect. Follow the system prompts.
The limit on concurrent sessions is not applicable to the REST API used for Advanced Features.
After reaching the maximum number of concurrent login sessions, or when users abruptly end their login session, you can remove a user session from the Management > Users > User Sessions tab.

Multiline Delimiter

Sets a character string to be used as line delimiter in multiline logs.

Purge stale devices

Enables the option to purge stale devices based on the last time data was received. For more information, see Purge Stale Devices.

Purge Stale Devices Period

Specify the number of days after which stale devices must be purged.

SSH Daemon at Startup

The SSH Daemon provides access to the appliance's Command Line Interface (CLI) from SSH clients.

By default, the SSH Daemon is turned on in the appliance. Click the slider to No to disable the SSH Daemon when you reboot the appliance. For details, see Command Line Interface (CLI).

Auto-identify Log Sources

Automatically detects any syslog log sources connected to the appliance. This includes:

Multiple log sources sharing the same IP address.
LogLogic LMI considers multiple sources using the same IP address as a single host, because LogLogic LMI uses the IP address to uniquely identify them.
Log sources whose log data is converted to syslog during collection

To view all identified log sources, use Management > Devices. If you do not enable this option, you must manually add the following log sources.

Note: If the Auto-identify Log Sources option detects a log source but does not recognize the exact type, the appliance adds it to the Management > Devices list as a general syslog log source.

To manually change a general Syslog log source type:

In the Management > Devices tab, click the log source name.
From the Device Type list, select the specific device type.
Click Update.

The Type column displays the device type you associated with the auto-identified log source.

If you enable Auto-identify Log Sources and you have several thousand devices configured that need to be auto-identified, routing rules and alerts can slow the auto-identify process down.

DNS Resolve All Device Names

Updates the DNS Resolve Flag for multiple devices.

Note: If you select No, the Management > Devices > Apply this update to all devices, not just to those on this page check box overrides your General settings No option.

Full Text Indexing

Allows indexing of data. You can set this for your appliances independently. If enabled, all data is indexed.

Note: Indexing uses additional storage.

To retain the index data, configure rules from Administration > Data Retention Rules.

Allow Disabling of admin Super User

Allows an admin user to disable the admin super user account. For more information, see Managing Users.

UI Verbose Logging

Enables or disables logging detailed error messages on the GUI. The default value is Yes.

If you select No, detailed logging is disabled, and a generic message is displayed instead of error or exception details. You can view the detailed information in syslog files by accessing the machine through SSH.

Log parsing for reports

Enable or disables parsing in LogLogic LMI, so that no content is added to the Real Time database-driven reports.

The default value is Yes.

This feature is only available on LogLogic EVA, LogLogic LX Appliances, and LogLogic MX Appliances, and in effect makes them similar to a LogLogic ST Appliance.

Manage Device

Enables or disables the ability for users to configure or add devices under Management > Devices. This setting overrides the Manage Devices privilege provided to a user or role, except to the admin super user account.

Accept Detail

Allows drill down for the Real Time and Summary detail reports.

Note:

This option is not available on LogLogic ST Appliances.
You must enable this option to view Reports > Network Activity > Accepted Connections > Network Activity > Application Distribution, and detail reports. This might require additional time and storage in downloading these reports.

General Settings