Page History

...

• Service
  • The Log Management Service is available from JOC Cockpit within the scope of JS7 - Services.
  • The Log Management Service offers high availabilityrestart capabilities: in case of fail-over or switch-over of JOC Cockpit the Log Management Service will become available from the active JOC Cockpit instance.
• Clients
  • All The JS7 products, JOC Cockpit, Controller and Agents that can act as a client clients to the Log Management Service, . The products can be configured to report log output to the JS7 Log Management Service.
  • Log In addition, log output of JS7 products is always written to local log files. In addition, log output can be forwarded to the Log Management Service.
  • Users have a choice to enable forwarding of log output per instance of a JS7 product during installation and or later on by adjusting the Log4j2 configuration. 

...

By default the Log4j configuration of JS7 products will not make use of the Log Management Service. Instead, users choose for which instances of JS7 products they want to send log output to the Log Management Service.

...

The following Log4j2 configuration is available from the log4j2.xml-example file available available with a in the Controller's data <controller-data>/config directory:

<Appenders>
    <Syslog name="RFC5424" format="RFC5424" host="localhost" port="4514"
            protocol="UDP" charset="UTF-8" facility="LOCAL0" newLine="false">
        <PatternLayout pattern="<134>1 %d{ISO8601}{ETC/UTC}Z ${hostName} JS7 Controller {
"host":"${hostName}",
"controllerId":"${ControllerId}",
"thread":"%t",
"level":"%p",
"logger":"%c{1}",
"message":"%enc{%m}{JSON}",
"thrown":"%enc{%throwable{10}}{JSON}"
}"
        />
    </Syslog>
</Appenders>

...

The following Log4j2 configuration is available from the log4j2.xml-example file available available with a Controllerin the Agent's data <agent-data>/config directory:

<Appenders>
    <Syslog name="RFC5424" format="RFC5424" host="localhost" port="4514"
            protocol="UDP" charset="UTF-8" facility="LOCAL0" newLine="false">
        <PatternLayout pattern="<134>1 %d{ISO8601}{ETC/UTC}Z ${hostName} JS7 Controller {
"host":"${hostName}",
"controllerId":"${ControllerId}",
"agentId":"...",
"level":"%p",
"logger":"%c{1}",
"message":"%enc{%m}{JSON}",
"thrown":"%enc{%throwable{10}}{JSON}"
}"
        />
    </Syslog>
</Appenders>

...

The following Log4j2 configuration is available from the log4j2.xml-example file available available with a Controller's data in the JOC Cockpit's <jetty-base>/resources/joc directory:

<Appenders>
    <Syslog name="RFC5424" format="RFC5424" host="localhost" port="4514"
            protocol="UDP" charset="UTF-8" facility="LOCAL0" newLine="false">
        <PatternLayout pattern="<134>1 %d{ISO8601}{ETC/UTC}Z ${hostName} JS7 Controller {
"host":"${hostName}",
"controllerId":"${ControllerId}",
"agentId":"...",
"level":"%p",
"logger":"%c{1}",
"message":"%enc{%m}{JSON}",
"thrown":"%enc{%throwable{10}}{JSON}"
}"
        />
    </Syslog>
</Appenders>

...

The JS7 Log Management Service is offered for convenience purposes as it allows to access log files offers access to log output of JS7 products from JOC Cockpit as a central point of viewmonitoring & control.

Due to limitations of the underlying Syslog Protocol the JS7 Log Management Service does not meet all elaborated requirements for security, resiĺience and high availability.

The Log Management Service is offered for convenience purposes. The , the authoritative source of log output remains with log files created by the JS7 products.

Security

The Syslog Protocoll does not cover authentication of Clients:

• This translates to the fact that log messages can Log messages could be faked by malicious 3rd-party components as the JS7 Log Management Service cannot authenticate and reliably identify the source of log output.
• Users are warned in case that they take action based on messages arriving with the JS7 Log Management Service: severe messages that suggest immediate action should be verified from the JS7 product's log files.

...

• Flooding of messages is a possible scenario for attacks that is not covered by the Syslog Protocol.
• The JS7 Log Management Service will try to identify such scenarios and will shut down. The behavior is intended to keep the JOC Cockpit that operates the Log Management Service free from operational in case of DNS attacks.

Resilience

The Log Management Service accepts messages sent via the UDP protocol only.

• TCP connections are out of scope due to their blocking nature.
• UDP messages can arrive in an any sequence.

The Log Management Service performs input sanitization.

• This includes that any log messages, for example carrying HTML tags, will be dropped.
• Messages sent to the Log Management Service must be compliant to the above Log4j configuration and otherwise will be dropped..

High Availability

The JS7 Log Management Service is subject to clustering of offers restart capabilities when operated from a JOC Cockpit cluster:

• This allows the service to switch from a current JOC Cockpit instance to the next active JOC Cockpit instance.
• Switching to a different host operating the then active JOC Cockpit instance includes that the hostname of the Log Management Service will change,. Users are encouraged to can set up a Proxy Service that will forward log messages to the currently active JOC Cockpit instance.

...

• In a situation when no JOC Cockpit instance is active UDP messages will be lost.
• Periods Short periods of unavailability of JOC Cockpit can occur in case of fail-over and switch-over that take up to approx. 30s but can be prolonged if a larger number of orders is present.

...