LogChain

Enterprise

Synopsis

Agents keep the data they collect in queue files, often for hours or days, before they upload it to their Director. LogChain proves that nobody changed that data on the way to the Director or while it waited in a queue.

Each agent signs its data with its own key before it queues it. The Director checks the signatures of every upload before it stores anything. Records that were changed, reordered or removed fail the check.

The proof covers data the Director can check: data signed with a key it holds. Data that isn't signed, or is signed with a key it doesn't hold, can't be checked. Whether the Director refuses it or accepts it with an alert is one of the two choices.

LogChain is set on a standalone Director or on a cluster. A cluster's setting applies to every Director in it.

Requirements

• Edition - Enterprise. Other editions see an Enterprise card in place of the section.
• Versions - Directors and agents at version 2.5.1 or later. Older ones are listed on the tab (see What the Tab Shows), and their data isn't signed.
• Permissions - Changing the setting needs the same permission as any other change to the Director or the cluster.

Turning It On

LogChain is in the Data integrity section of the TLS and data integrity step of the Director and cluster creation wizards. After creation, open the Director or the cluster, select the TLS and data integrity tab and click Manage TLS and data integrity.

Turn on the LogChain switch. Two choices then appear.

The Two Choices

Each choice is Reject or Accept and alert:

Choice	Default	Applies to
When the check fails	Reject	Data that changed after the agent signed it
When data isn't signed	Accept and alert	Data an agent queued before LogChain reached it, data from an agent older than 2.5.1, and data signed with a key the Director doesn't hold

• Reject - The Director refuses the upload and stores nothing. The agent moves the file to a separate folder and goes on with the next one. Nothing of the file reaches a target.
• Accept and alert - The Director keeps the data, sends it on as usual and raises an alert.

Data is signed with a key the Director doesn't hold when an agent signed it before its Director joined or left a cluster, since the key changes from the Director's to the cluster's, or before the agent moved to another Director. The Director can't check such data, so it treats it as not signed.

Turning It On for Agents That Already Hold Data

Agents can hold data for hours or days. Everything they queued before LogChain reached them isn't signed, and When data isn't signed applies to it from the first upload.

warning

Keep When data isn't signed on Accept and alert until the agents' queues are empty. Do the same while Directors join or leave clusters, and while agents move to another Director, until the data they signed before is sent. Reject refuses that backlog.

What the Tab Shows

• While LogChain is on, a warning names the Directors and agents that are too old for it, with their versions.
• A Director in a cluster shows the cluster's setting read-only, with Go to cluster.
• After a downgrade to an edition without LogChain, it stays on, read-only, with one action: Turn off LogChain, which asks first. Without the Enterprise edition it can't be turned back on.

The Agent Page

The Device information panel of an agent shows a LogChain row with one of four states, and one sentence that says why:

State	Meaning
Active	The Director checks that the agent's data arrives unchanged, in order and complete
Waiting for an agent update	LogChain is on, but the agent is too old to sign its data
Waiting for a director update	LogChain is on, but the Director, or a Director in the cluster, is too old to use it
Disabled	LogChain is off for the agent's Director or cluster, or the agent has no Director yet

Alerts and the Activity Log

• The system alert rule LogChain check failed fires when a Director finds data that failed the check, isn't signed, or is missing from an agent's sequence, or when it refuses files. The alert names the agent and the table. See System rules under Rules.
• Every refused file is recorded in the activity log as LogChainFileRejected, for example "LogChain rejected 3 files from web-01 (table syslog): A record was changed after the agent signed it." See Audit.
• A file missing from an agent's sequence is always accepted, with an alert: the file that arrived is intact. Files an agent dropped from its queue because of their age or size are not reported as missing, since the agent tells the Director about them.

Limits

• LogChain proves that data did not change after it was signed. It does not prove which agent signed it.
• Agents of version 1.10, which send their data over the Director's message queue, are not checked.
• Turning LogChain off stops the checks. Files that agents sign while it is off are not checked later.

Configuration

The setting is logchain, in the properties of a standalone Director or a cluster:

logchain:
  status: true
  on_broken: reject
  on_unsealed: accept_alert

Field	Default	Values
status	false	true turns LogChain on
on_broken	reject	reject or accept_alert: when the check fails
on_unsealed	accept_alert	reject or accept_alert: when data isn't signed

The VirtualMetric/directors and VirtualMetric/clusters template resources take the same properties.logchain. Turning LogChain on, or changing it while it is on, needs the Enterprise edition. Turning it off never does.