Logging engine configuration

Introduction

This section describes how to configure the TSS integrated Logging engine. This engine is automatically installed with the TSS firmware and is dedicated to listening and storing the log messages coming either through Syslog or through Syslog over WebSocket. It comes in the form of a Windows service that can be controlled (started/stopped/restarted/ and is configured to start automatically by default.

•Logging engine configuration

•Syslog Retrieval (Troubleshooting Guide)

Logging engine configuration on the TSS

On a standard TSS, changing this configuration requires accessing the TSS server file system. The following file contains the configuration of the Logging engine:

C:\Program Files\IPTrade\LoggingService\application.cfg

The settings below are available:

Setting key name	Default value	Name	Description
syslog.port	514	Syslog port	Defines the port on which the TSS listens for Syslog events. Numerical value. Must be a valid and free port on the TSS machine.
syslog.http.port	8000	Syslog over WebSocket port	Defines the port on which the TSS listens for Syslog events sent through WebSocket. Numerical value. Must be a valid and free port on the TSS machine.
syslog.https.port		Syslog over secure WebSocket port	Defines the port on which the TSS listens for Syslog events sent through secure WebSocket (WebSocket over HTTPS). Numerical value. Must be a valid and free port on the TSS machine. Empty value means the TSS does not listen for events sent through secure WebSocket.
syslog.path	F:\Syslog (VA) C:\Syslog (non-VA)	Storage path	Defines the local path where the TSS stores the Syslog data. This path must have neough free space to hold the maximum Syslog data.
syslog.filesize	5	File size	Defines the maximum size of individual Syslog files on the TSS. The Logging Engine automatically creates a new file for any device when the file size exceeds this specified size. The result is several files with index-based names (Syslog.device_id.log, Syslog.device_id.log.001, Syslog.device_id.log.002, ...). Numerical value, in MB.
syslog.totalday	180	Retention period	Defines how long a Syslog data file is kept before being cleaned up automatically. A Syslog file is automatically deleted when its last write time is older than the retention period. Numerical value, in days.
syslog.totalsize	1024	Maximum storage used	Defines how much disk space can be used to store Syslog data. Oldest files are automatically deleted to stay under this limit. Numerical value, in MB.

Once you have updated the configuration, save the file and then restart the "IPTRADE Logging Service" Windows service to apply the new settings.

Syslog source identification

By default, turrets and TPO devices use their own device ID to identify their Syslog trace files. This behavior can be altered with the following two settings:

Location: Terminal Boot Settings

Global

Syslog is based on Device Identifier	truefalse
Key: application.boot.trace.source.deviceid Description: Define if syslog is based on Device Identifier or not. If not, syslog is based on Device IP address. By default, syslog is based on Device Identifier. Using MAC address or free identifier instead of IP address as syslog source is out of the syslog standards (see https://tools.ietf.org/html/rfc5424). In case of external syslog server usage (not TSS and alternate TSS syslog server), it's highly recommended to set this configuration key to false that makes the syslog messages to be sent with IP address as syslog source. Constraint: true \| false

Location: TPO Boot Settings

Global

Syslog is based on Device Identifier	truefalse
Key: application.boot.tpo.trace.source.deviceid Description: Define if syslog is based on Device Identifier or not. If not, syslog is based on Device IP address. By default, syslog is based on Device Identifier. Using MAC address or free identifier instead of IP address as syslog source is out of the syslog standards (see https://tools.ietf.org/html/rfc5424). In case of external syslog server usage (not TSS and alternate TSS syslog server), it's highly recommended to set this configuration key to false that makes the syslog messages to be sent with IP address as syslog source. Constraint: true \| false

Syslogs over WebSocket configuration

To enable Syslogs over Websocket on turrets and TPO, the WebSocket URI of the logging engine must be added in boot settings with the following key:

trace.target@websocket.server = <WebSocket logging engine URI>

Example :

trace.target@websocket.server = ws://echo.websocket.org

The WebSocket (WS) protocol is used when the URI starts with "ws://".

The WebSocket Secure (WSS) protocol is used when the URI starts with "wss://".

The only way to secure syslogs is by using the WebSocket Secure protocol.