Infoblox VMware vrealize Log Insight Content Pack User Manual Version 1.1

Transcription

1 Infoblox VMware vrealize Log Insight Content Pack User Manual Version 1.1

2 Release History S# Version Date History May 2015 Initial Version May 2015 IPAM, DHCP and DNS Dashboard changes for Infoblox DDI VMware vrealize LogInsight Content Pack version 1.5 Copyright 2015 Infoblox. All Rights Reserved. 2

3 Table of Contents 1 Introduction Infoblox vrealize Log Insight Content Pack Installation Dashboards General - Overview Dashboard General Security Dashboard IPAM Configuration Dashboard DNS Configuration DHCP Configuration Alerts Extracted Fields Getting Support for the Infoblox Content Pack for Log Insight Copyright 2015 Infoblox. All Rights Reserved. 3

4 1 Introduction The Trinzic Network Services and Management family of products enable companies to manage, control, and optimize DNS, DHCP, and other services. The product family leverages existing investments, paves the way to the Cloud, and ensures network services uptime. VMware vrealize Log Insight delivers automated log management through log analytics, aggregation and search. Infoblox DDI appliance provides comprehensive logs for DHCP, DNS and IPAM events and they are provided to Infoblox vrealize Log Insight Content Pack. Infoblox vrealize Log Insight Content Pack provides powerful visualizations into DHCP, DNS and IPAM events for proactive monitoring and auditing. Customers can monitor multiple DDI appliances from vrealize Log Insight appliance using Infoblox vrealize Log Insight Content Pack. It provides for 1. Powerful Monitoring Customers can monitor DHCP, DNS and IPAM Configuration for quick problem resolution. Additionally the Content Pack provides authentication and system status information. 2. Alerting Customers can configure alerts for configuration changes in DHCP, DNS and IPAM as well as on Authentication events. 3. Break down of Events Infoblox vrealize Log Insight Content Pack provides multiple extracted fields, from the events, which helps in trouble shooting and root cause analysis. 2 Infoblox vrealize Log Insight Content Pack Installation To install the Content Pack, click on the three lines next to admin. Copyright 2015 Infoblox. All Rights Reserved. 4

5 Click Content Packs Select Import Content Pack at the lower left corner of the screen Copyright 2015 Infoblox. All Rights Reserved. 5

6 Browse to the location of the Content Pack Click on Import Copyright 2015 Infoblox. All Rights Reserved. 6

7 3 Dashboards Infoblox VMware vrealize Log Insight Content Pack provides the following dashboards - General Overview This dashboard gives the consolidated information of IPAM, DHCP, DNS and Restart events General Security This dashboard provides the information about successful and failed log in events. IPAM Configuration This dashboard displays information about IPAM Network container and IPAM Network events. DNS Configuration This dashboard displays information about DNS Zone events and DNS Host Record events. DHCP Configuration This dashboard displays information about DHCP Range and DHCP Reserved Range events. 3.1 General - Overview Dashboard General Overview Dashboard provides the consolidated information for IPAM, DNS and DHCP and restart events. It has the following widgets - IPAM Configuration Events Over Time Total number of of IPAM events received over time. This includes IPAM Network Container and Network - Creation, Modification and Deletion events. DNS Configuration Events Over Time Copyright 2015 Infoblox. All Rights Reserved. 7

8 The total number of DNS events received over time. These include DNS configuration and run time events. Note: 1. DNS configuration events include Zone Creation, Modification and Deletion events. 2. DNS run time events include Host Record Creation, Modification and Deletion events. DHCP Configuration Events Over Time Total number of DHCP events received over time. This includes DHCP Range and Reserved Range - Creation, Modification and Deletion events. Grid Service Restart Events Over Time Grid service restarts are required for the NIOS to load the configured settings. This chart displays all the Grid service restart events over time. 3.2 General Security Dashboard This dashboard provides the widgets for Failed Authentication Events Over Time This chart displays the failed log in Authentication events over time. Successful Authentication Events Over Time This chart displays the successful log in Authentication events over time. Logout Events Over Time This chart displays the successful log out Authentication events over time. Copyright 2015 Infoblox. All Rights Reserved. 8

9 Failed Authentication Events With Details This chart displays the failed log in Authentication event along with details. Failed and Successful Events by Source This chart displays the Failed and Successful log in Authentication by source. Failed Events by Connector IP This chart displays the failed log in Authentication events grouping by Connector IP. 3.3 IPAM Configuration Dashboard This dashboard contains the widgets for Network Container Events Over Time This chart displays the IPAM Network Container Creation, Modification and Deletion events over time. Network Container Events By Operation This chart displays the IPAM Network Container events by operation type - Creation, Modification or Deletion. Network Container Events By Network Container Address This chart displays the IPAM Network Container events by the Network Container address. Network Events Over Time This chart displays the IPAM Network Creation, Modification and Deletion events over time. Network Events By Operation Copyright 2015 Infoblox. All Rights Reserved. 9

10 This chart displays the IPAM Network events by operation - Creation, Modification or Deletion. Network Events By Network Address This chart displays the Network events by the network address. 3.4 DNS Configuration This dashboard contains the widgets for DNS Zone Events Over Time An authoritative zone is a zone for which the local (primary or secondary) server references its own data when responding to queries. The local server is authoritative for the data in this zone and responds to queries for this data without referencing another server. This chart displays the DNS Zone Creation, Modification and Deletion events over time. DNS Zone Events By Operation An authoritative zone is a zone for which the local (primary or secondary) server references its own data when responding to queries. The local server is authoritative for the data in this zone and responds to queries for this data without referencing another server. This chart displays the DNS Zone events by operation type - Creation, Modification or Deletion. DNS Zone Events By FQDN Copyright 2015 Infoblox. All Rights Reserved. 10

11 An authoritative zone is a zone for which the local (primary or secondary) server references its own data when responding to queries. The local server is authoritative for the data in this zone and responds to queries for this data without referencing another server. This chart displays the DNS Zone events by FQDN. DNS Host Record Over Time A host record defines attributes for a node, such as the name-to-address and address-toname mapping. This alleviates having to specify an A record and a PTR record separately for the same node. A host can also define aliases and DHCP fixed address nodes. The zone must be created first before adding a host record for the zone. This graph displays the DNS Host Record Creation, Modification and Deletion events over time. DNS Host Record Events by Operation A host record defines attributes for a node, such as the name-to-address and address-toname mapping. This alleviates having to specify an A record and a PTR record separately for the same node. A host can also define aliases and DHCP fixed address nodes. The zone must be created first before adding a host record for the zone. This graph displays the DNS Host Record events by operation - Creation, Modification or Deletion. DNS Host Record Events by FQDN An authoritative zone is a zone for which the local (primary or secondary) server references its own data when responding to queries. The local server is authoritative for the data in this zone and responds to queries for this data without referencing another server. This chart displays the DNS Zone events by FQDN. Copyright 2015 Infoblox. All Rights Reserved. 11

12 3.5 DHCP Configuration This dashboard displays information about DHCP Range and DHCP Reserved Range events DHCP Range Events Over Time This chart displays the NIOS DHCP Range Creation, Modification and Deletion events over time. DHCP Range Events By Operation This chart displays the NIOS DHCP Range events by operation - Creation, Modification or Deletion. DHCP Range Events By Range Address This chart displays the DHCP Range events by Range Address. DHCP Reserved Range Events Over Time This chart displays the DHCP Reserved range Creation, Modification and Deletion events over time. DHCP Reserved Range Events By Operation This chart displays the DHCP Reserved Range events by operation - Creation, Modification or Deletion. DHCP Reserved Range Events By Reserved Range Address This chart displays the DHCP Reserved Range events by Reserved Range Address. Copyright 2015 Infoblox. All Rights Reserved. 12

13 4 Alerts Infoblox vrealize Log Insight Content Pack provides the alerts for the following - NIOS Any Authentication Event This alert is sent on any Authentication event in NIOS. NIOS Any DHCP Configuration Event This alert is sent on any DHCP Range or DHCP Reserved Range configuration event in NIOS. NIOS Authentication Failed Event This alert is sent on Authentication failure. NIOS Any IPAM Configuration Event This alert is sent on any IPAM Network or Network configuration event. NIOS Any DNS Configuration Event This alert is sent on any DNS Zone or DNS Host Record configuration event. Copyright 2015 Infoblox. All Rights Reserved. 13

14 5 Extracted Fields Infoblox vrealize Log Insight Content Pack provides the following extracted fields nios_cidr This field gives the CIDR for the Network Address. nios_dhcp_range_operation This field gives the NIOS DHCP Range operation type. Copyright 2015 Infoblox. All Rights Reserved. 14

15 nios_dhcp_range This field gives the DHCP Range which has been created. nios_dns_view This field gives the NIOS DNS view. Copyright 2015 Infoblox. All Rights Reserved. 15

16 nios_dns_zone_operation This field gives the NIOS DNS Zone operation type. nios_fqdn This field gives the Fully Qualified Domain Name which has been configured. Copyright 2015 Infoblox. All Rights Reserved. 16

17 nios_grid_member This field gives the NIOS Grid member information. nios_host_record_addr This field gives the Host Record which has been created. Copyright 2015 Infoblox. All Rights Reserved. 17

18 nios_host_record_fqdn This field gives the FQDN in the Host Record. nios_host_record_operation This field gives the Host Record operation type. Copyright 2015 Infoblox. All Rights Reserved. 18

19 nios_network This field gives the Network which has been created. nios_network_container This field gives the Network Container which has been created. Copyright 2015 Infoblox. All Rights Reserved. 19

20 nios_network_container_operation This field gives the Network Container Operation type. nios_network_operation This field gives the Network Operation type. Copyright 2015 Infoblox. All Rights Reserved. 20

21 nios_network_view This field gives the network view. nios_ns_group This field gives the NS group name. Copyright 2015 Infoblox. All Rights Reserved. 21

22 nios_reserved_range_operation This field gives the NIOS DHCP Reserved Range operation type. nios_reservedrange This field gives the DHCP Reserved Range which has been created. Copyright 2015 Infoblox. All Rights Reserved. 22

23 nios_security_apparently_via This field gives the source of the Authentication event. nios_security_connector_ip This field gives the Security connector IP address information. Copyright 2015 Infoblox. All Rights Reserved. 23

24 nios_trigger_event This field gives the Security connector IP address information. 6 Getting Support for the Infoblox Content Pack for Log Insight Infoblox does not offer telephone support for the Infoblox Content Pack for Log Insight. If you require technical assistance or have any questions, comments or feedback related to this content pack please post them to Infoblox Community at this URL: Copyright 2015 Infoblox. All Rights Reserved. 24