Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Mounting devices for log offload on InterScan Web Security Virtual Appliance (IWSVA)

    • Updated:
    • 4 May 2017
    • Product/Version:
    • InterScan Web Security Virtual Appliance 6.5
    • Platform:
    • N/A N/A
Summary

IWSVA has a log storage limit. If you do not want to purge old logs, you can offload the logs to an external device for permanent storage and if you want to analyze them in the future, you can retrieve these logs from the storage device and restore them in IWSVA.

IWSVA enables you to offload logs to the following:

  • External hard drive or USB flash drive
  • Unix NFS share folder
  • Windows share folder
  • A folder on local hard drive

For more details, refer to the IWSVA online help topic about Mounting Devices for Log Offload.

However, if you want to add a new hard drive to the IWSVA virtual machine and mount it for Log Offload, follow the steps below.

Details
Public
 

If the new hard disk is already recognized by IWSVA, skip the first step and go to step 2. You can confirm it using the following command:

# ls /dev/sd*

  1. Add a new hard disk on IWSVA VM. If it is the second disk, its name would be /dev/sdb. For the third disk, it would be /dev/sdc.

    1. Use the command to list all available partitions:

      # ls /dev/sd*

    2. Determine which SCSI host is in use:

      # grep mpt /sys/class/scsi_host/host?/proc_name

      The command will return a line such as "/sys/class/scsi_host/host0/proc_name:mptspi". In this example, the SCSI host is "host0".

    3. Then rescan the bus by informing the SCSI host that has been determined in the previous step. The 3 “-” are acting as wildcards to represent the “Channel, SCSI ID and LUN” that are available on a SCSI host.

      # echo "- - -" > /sys/class/scsi_host/host0/scan

    4. Repeat the command to list all available partitions and note that the new disc is now listed. In this example, the new disk is /dev/sdb.

      # ls /dev/sd*

      new disk

  2. Create a partition and change its type to Linux Logical Volume Manager (LVM):

    # fdisk /dev/sdb

    • Type n = add new partition
    • Type p = primary
    • Type 1 = only one partition
    • Press Enter to use the Default First cylinder
    • Press Enter to use the Default Last cylinder
    • Type w = Save the changes

    create a partition

  3. List all available partitions and note that the new partition is now listed. In this case the new partition is /dev/sdb1:

    # ls /dev/sd*

  4. Run the command "mke2fs -j /dev/sdb1" to format /dev/sdb1.

    # mke2fs -j /dev/sdb1

     
    Make sure to type the right partition. Otherwise, this command will format the incorrect partition and damage the IWSVA installation.

    format

  5. On the IWSVA WebUI, go to Logs > Log Settings. On the Mount device field, enter the new "/var/offload" device /dev/sdb1 then click Mount.

     
    The purge days must be more than 45.

    On the Store logs for field, enter "45". Select the Log Offload checkbox then click Save.

    mount the new device

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1117092
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.