SONICWALL CONSOLE Administration User Guide

June 14, 2024
SONICWALL

CONSOLE Administration

Product Information

Specifications:

  • Appliance
  • Switching Between Modes
  • System
  • Diagnostics
  • 3rd Party
  • IPM
  • Settings
  • Notifications
  • Configuring Email
  • Configuring an Email Group

Product Usage Instructions

Administration

The administration section provides information on how to manage
and configure the product.

Console Introduction

This section provides an introduction to the product
console.

Contents

This section provides a table of contents for the user
manual.

Related Documents

This section provides a list of related documents that provide
additional information on the product.

Appliance

The appliance section provides information on the different
modes of operation of the product.

Switching Between Modes

This section explains how to switch between different modes of
operation.

System

The system section provides information on the overall system
configuration and settings.

Diagnostics

The diagnostics section provides information on how to
troubleshoot and debug issues with the product.

Debug Log Settings

This section explains how to configure debug log settings for
troubleshooting purposes.

Summarizer Status

This section provides information on the status of the
summarizer feature.

Summarizer Details

This section provides detailed information on the summarizer
feature.

Syslogs Details

This section provides detailed information on the syslogs
feature.

3rd Party

The 3rd party section provides information on integrating
third-party software or devices with the product.

Key Assignments

This section explains how to assign keys for use with
third-party software or devices.

Generating a New Key

This section explains how to generate a new key for use with
third-party software or devices.

IPM

The IPM section provides information on configuring and managing
IPM settings.

Settings

This section provides information on configuring IPM
settings.

Notifications

The notifications section provides information on configuring
and managing notifications.

Global Alert

This section explains how to configure global alerts for
notifications.

Mail Group

This section provides information on configuring mail groups for
notifications.

Configuring Email

This section provides instructions on how to configure email
settings for notifications.

Configuring an Email Group

This section explains how to configure an email group for
notifications.

Frequently Asked Questions (FAQ)

Q: How do I switch between different modes of operation?

A: To switch between different modes of operation, refer to the
“Switching Between Modes” section in the Appliance category of the
user manual.

Q: How do I troubleshoot issues with the product?

A: To troubleshoot issues with the product, refer to the
“Diagnostics” section in the user manual for information on
debugging and log settings.

Q: How do I configure email notifications?

A: To configure email notifications, refer to the “Configuring
Email” section in the Notifications category of the user
manual.

SonicWall® Analytics CONSOLE
Administration

Contents

Console Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Switching Between Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 File Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Backup/Restore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Flow Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 IPM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Debug Log Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Summarizer Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Summarizer Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Syslogs Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3rd Party . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Key Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Generating a New Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Flow Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Process Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Analytics CONSOLE Administration

2

Contents

IPM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
CPU/Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Memory/RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Storage/Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Estimated Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Capacity Estimation Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Global Alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Mail Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Configuring Email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Configuring an Email Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 View Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Changing your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Enabling Two- Factor Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Configuring the Miscellaneous Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Summarizer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Syslog Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Email/Archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Scheduled Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Managing the Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Navigating the Schedules Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 License Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Managing Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Refreshing Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Uploading a License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
SonicWall Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Analytics CONSOLE Administration

3

Contents

1
Console Introduction
This document describes the CONSOLE function for on-premises Analytics. This is a management function where you can set the parameters for the on-premises Analytics features. For example, you can manage the license, set the thresholds for IPM, and set your log configurations, and so forth. Both Syslog-based Analytics and IPFIX-based Analytics are included. When accessing the Analytics CONSOLE, the default page is View Log (CONSOLE > Log > View Log), which is the same for Syslog-based and IPFIX-based Analytics.

In addition to the log information in the main window, several icons appear in the top right corner.

Icons System Status icons
Alerts and Notifications Center

Description
Provide system status. Click on the individual icons for more detail. The color of the icon indicates the status. A color other than green, indicates that features needs attention.
· CPU/Processor · Memory/RAM · Storage/Disk · Estimated Capacity
Available only for IPFIX-based Analytics. Click to open the Alerts and Notifications Center. The number on the icon indicates the number of unacknowledged alerts.

Analytics CONSOLE Administration

4

Console Introduction

Icons Online Help
User ID

Description Accesses the online help and the Analytics API.
Indicates the user, the product version, and allows you to log out of the application.

Contents

This document supports both IPFIX-based reporting and Syslog-based reporting. Some of the features are the same in both styles; some features are specific to one style of reporting. The table below describes which chapters apply to which type of Analytics.

Contents for IPFIX-Based Reporting Appliance Diagnostics 3rd Party Flow Agent IPM Notifications Log Management
Licenses

Contents for Syslog-Based Reporting Appliance Diagnostics
IPM
Log Management Reports Licenses

Related Documents
The following documents provide additional information about Analytics or related firewall management applications:
· Analytics HOME Administration · Analytics REPORTS Administration · ANALYTICS Administration · Analytics NOTIFICATIONS Administration

Analytics CONSOLE Administration

5

Console Introduction

2
Appliance
This chapter describes the Appliance command option for IPFIX-based, on- premises Analytics. With this command, you can switch between CONSOLE mode and Appliance mode.
Topics:
· Switching Between Modes · System · Network · Deployment · IPM
Switching Between Modes
When you first select the CONSOLE view, the Appliance option is visible in the command menu. From here you can access the firewalls associated with you implementation.
To switch to the Appliance view:
1 Navigate to CONSOLE > Appliance. 2 Click the second Appliance link.
The menu options change to reflect the commands you can run against the appliance you selected. The Appliance command changes to Analytics, and the System command appears with several options you can define.

Analytics CONSOLE Administration

6

Appliance

To return to the CONSOLE view:
1 Click on Analytics. 2 Select Console.
The menu options change back to the console management commands.

System
System command on the left navigation panel allows you to access the firewalls in your implementation and get information about them. You can also perform some basic administrative tasks on the firewall. After the System command is expanded, you see its sub-commands, which are listed below:
· Status · Licenses · Time · Administration

Analytics CONSOLE Administration

7

Appliance

· Settings · Diagnostics · File Manager · Backup/Restore · Shutdown
Status
The System > Status page provides general information about the systems you are running. The Status sections are:
· GENERAL: Lists the product name, serial number, version, flow agent firmware version, license, and role.
· SYSTEM: Gives the host name, IPv4/6 addresses, the time, up time, the OS, CPU, RAM, and available disk space on Install and Data partitions.

Analytics CONSOLE Administration

8

Appliance

· GETTING STARTED: Gives useful information on how access information for your on-premises system.
Licenses
The System > Licenses page identifies the status and types of your licenses. You can use this page to manage, refresh or upload licenses. It also includes information about the security service and support service that may be licensed or not. Capacity and expiration are also listed to help manage your licenses more easily.

Use the three buttons at the bottom of the Licenses table to manage the data.
1 Click the Manage button to see your license Serial Number at the top right of the popup window that displays.

· Enter your MySonicWall username/email in the text field provided. · Enter your Password in the text field provided.

Analytics CONSOLE Administration

9

Appliance

· Click LOGIN to see your license details. · Click the Forgot your Username or Password? link if needed. · Click Return to License Summary to go back to the Licenses page. 2 Click Refresh to update your Licenses page view. 3 Click the Upload button to access the UPLOAD LICENSES popup window.
· Find your license Serial Number under UPLOAD LICENSES. · Click Choose File to browse for your license document to upload. · Click Upload to finish transferring your license. · Click Cancel to call off your selection.
Time
The System > Time page shows the time that is used for the system time stamp. You can reset the time here or choose another time zone to operate in. You can also automatically configure the date and time using NTP servers.

Analytics CONSOLE Administration

10

Appliance

1 To manually select the time, under SYSTEM TIME, select the Time, Date, and Time Zone. 2 To automatically set the time using an NTP server, select Set time automatically using Network Time
Protocol (NTP). 3 Enter the NTP Server addresses you want to synchronize in the text fields provided. The maximum is 5. 4 Click Add NTP Server and enter the IP address or domain name of the NTP server.
NOTE: The system time automatically adjusts the clock for daylight saving time.
5 Click Update to submit your system time configuration changes. 6 Alternatively, click Reset to reset the system time to factory defaults.
Administration
The System > Administration page helps you ensure the proper management and configuration of your on-premises Analytics system. It has three sections: HOST SETTINGS, ENHANCED SECURITY ACCESS (ESA), and ADMINISTRATOR PASSWORD.

1 Under HOST SETTINGS, enter the number of minutes of inactivity allowed before the session is logged out. A setting of -1 allows an unlimited amount of inactivity without being logged out.
2 Under ENHANCED SECURITY ACCESS (ESA), check the box next to Enforce Password Security, if desired, and adjust the settings. · The Number of failed login attempts before user can be locked out is 6 by default. · The number of User lockout minutes is 30 by default. · The Number of days to force a password change is 90 by default.
3 Under ADMINISTRATOR PASSWORD, check the Administrator Name, which is shown next to the entry. · Enter your Current Password in the text field provided.

Analytics CONSOLE Administration

11

Appliance

· Enter your New Password in the text field provided. · Confirm Password in the text field provided. · Click Update to make your changes. · Click on Enable 2FA to enable two-factor authentication. · Click Reset to revert the fields on the page to their default settings.
Settings
The System > Settings page provides the FIRMWARE UPGRADE/SERVICE PACK/HOTFIX for your system. To keep your system secure, keep it up to date with the latest SonicWall security patches and service packs. The page also lists the system Current Version with its build information in parenthesis. For example: (Build: 2507.2007 – Friday September 06, 2019 03:54:30 PM PDT).

NOTE: If you do not have the proper support licenses, a warning message with a red exclamation mark informs you that the product does not have valid support to download software updates. You can continue to apply hotfixes and service packs manually. For a major upgrade you need the proper product support license.
To upgrade your firmware, service pack, or hotfit:
1 Click the here link, next to the Current Version, for your system upgrade history of all hotfixes and firmware updates.
2 Click Choose File to find the file you wish to upload. 3 Click Apply.
Diagnostics
The System > Diagnostics page offers a debug setting that can help you diagnose issues more quickly. This action creates debug log files on all the SonicWall Analytics systems in this deployment, but it could hamper application performance by filling up disk space. You should reset to No Debug for normal operation as soon as the potential issue has been resolved.
IMPORTANT: The debug level should only be set based on guidance from SonicWall Customer Support.
IMPORTANT: When a higher the debug level is selected, more system resources are used to generate debug data and this, in turn, may lower the overall system performance.

Analytics CONSOLE Administration

12

Appliance

A debug log records database operations, system processes, and errors that can occur in your system. Test connectivity lists the end-to-end connectivity between networked devices. System log files record all the events happening in your network.
Debug Log Settings
Setting debug levels allows faster troubleshooting of potential application issues.
To set the debug level when instructed by SonicWall Customer Support:
1 Choose the System Debug Level from the drop-down choices: · No Debug · Level 1 (Codepath) · Level 2 (Simple) · Level 3 (Logic) · Level 4 (Detailed) · Level 5 (Highly Detailed)
2 Click Update to make your changes. 3 Click Reset to start again.
Reporting DB Debug Log Settings
Setting debug levels allows for faster troubleshooting of potential application issues. This action increases the log level of the reporting database in this deployment. This actions can fill up disk space and impact performacne. You should reset to Min Logs for normal operation as soon as the potential issue has been resolved.
NOTE: The debug level should only be set based on guidance from SonicWall Customer Support.

Analytics CONSOLE Administration

13

Appliance

To set the Reporting DB Debug Log Settings:
1 Specify whether you want Min Logs or Detail Logs from the drop-down list next to Reporting DB Debug Level:
2 Select License Manager Connectivity to test against the host name, lm2.sonicwall.com 3 Select SMTP Server Connectivity to change it in the Deployment > Settings screen. 4 Select Ping and enter the Host Name or IP Address of the server to ping in the text field provided. 5 Select Probe Test and enter the Host Name or IP Address of the server to probe.
The port to use can be specified after the host name, separated by a colon. Use square brackets to enclose an IPv6 Address when the port number is also specified. For example, [2604:b00:a:2:0:1:df96:c605]:1234 6 Click Test.
Download System/Log Files
You can download system and log files to monitor your system activity and troubleshoot problems. The system/log files section of the Diagnostics page displays up to 301 archived files. The files are divided into Application Logs, System Logs, and Web Server Logs.

Analytics CONSOLE Administration

14

Appliance

1 Click the check box next to Technical Support Report (TSR) to collect diagnostic information for your system.
2 Click the check box next to Logs to enable the Search Filter box. 3 In the Search Filter text field, specify filters to narrow your search. See the examples below:
· .log – for files with extension log · .?? – for files with 3-letter extensions ending in `g’ 4 Click Export to download your system/log files to your computer.
File Manager
The System > File Manager page helps you manage your system files efficiently and easily. Administrators often use this page to export system settings preference files (/etc) to another directory location for backup archiving.

Analytics CONSOLE Administration

15

Appliance

1 Under FILE SYSTEM, check the box next to Select Folder. 2 Choose one of 19 folders from the drop-down menu. The choices are:
· /etc · /etc/mibs · /etc/Prefs · /etc/Prefs/old · /Firmware · /Firmware/Current · /Firmware/Old · /Logs · /Logs/archivedLogs · /mysql/data · /syslogs · /syslogs/archivedSyslogs · /syslogs/badSyslogs · /Temp · /Tomcat/conf · /Tomcat/logs · /Tomcat/temp · /var/log · /ViewPoint/reports

Analytics CONSOLE Administration

16

Appliance

3 Check the box next to the file you want. Each file category displays different content.

4 Click the Export icon next to your file to download it. 5 Click the Delete icon next to your file to delete it. 6 In the Search Filter text field, specify filters to narrow your search.
7 Click the plus + icon in the top right of the table to Choose File to upload to your selected folder. The file management dialog box displays.
8 In the file management dialog box, navigate to the file you would like to upload and click Upload. 9 The selected file is now displayed next to Choose File. Click Upload to complete the file manager import. 10 For managing a batch of files, select multiple files from the list and click Export or Delete.

Analytics CONSOLE Administration

17

Appliance

Backup/Restore
The System > Backup/Restore page helps you schedule and create immediate snapshots of configuration settings and data on your system. You need a minimum of 10GB of free disk space to perform a backup/restore operation. Navigate to System > Status to check your available disk space.
Creating a Backup
1 Navigate to System > Backup/Restore. Click on Backup Now. a Basic contains “Configuration Files & Add Unit.xml files”. b Application contains “Configuration Files, Add Unit.xml files, Database & Settings”. c Complete contains “Configuration Files, Add Unit.xml files, Database & Settings and Reporting Database”.
2 Select “Basic or Application or Complete” based on your requirement. Click OK.
3 A zipped folder of the Backup Snapshot will be downloaded.
Restoring a Backup
Application and complete backups can only be restored to the same version they were generated from. To perform a restore of your Backup:

Analytics CONSOLE Administration

18

Appliance

1 Navigate to System > Backup/Restore. Click on Browse.
2 Browse and select the Backup Snapshot file. Once the file is selected click on Restore Now.
3 Select the required files and click OK. All the available options available are selected for restore by default.

Analytics CONSOLE Administration

19

Appliance

4 The restore will take few minutes depending on the size of the backup. 5 After the files are restored, you need to reboot your system.

6 After a successful reboot, the configuration and database from the backup will be applied to Analytics. 7 If the restoration needs to be done on a different server, the username & password should be the same
as on the old server, while creating the database.
Shutdown
This section allows you to shut down or restart your system. You can temporarily disconnect users and stop services. If you made any changes to the settings, be sure to apply them before you restart or shut down. The process of restarting generally takes about three minutes.

1 To restart your system, click Restart and then click OK in the confirmation dialog box. 2 To shut down your system, click Shutdown and then click OK in the confirmation dialog box.

Analytics CONSOLE Administration

20

Appliance

Network
Network is the third command on the left navigation panel for on-premises Analytics. After the Network command is expanded, you see its sub-commands, which are listed below. The sub-commands allow the administrator to configure Network-related settings.
· Settings · Routes
Settings
The Network > Settings page provides network settings configuration procedures for HOST, NETWORKING, IPV4 SETTINGS, and SEARCH SUFFIXES.

Host Settings

To configure host settings:
1 Enter the host Name in the text field provided. 2 Enter the host Domain name in the text field provided. 3 Click Update to apply the host and networking settings changes. 4 Click Reset to restore these settings to previous saved values.

Networking Settings

To configure networking settings:
1 Select IP type by clicking the radio button next to DHCP or Static. 2 Click Update to apply the host and networking settings changes. 3 Click Reset to restore these settings to factory defaults.

Analytics CONSOLE Administration

21

Appliance

IPV4 Settings
To configure IPV4 settings:
1 Enter the Host IP Address, Subnet Mask, Default Gateway, and optionally enter DNS Server 1, 2 and 3 IP addresses.
2 Click Update to apply the host and networking settings changes. 3 Click Reset to restore these settings to factory defaults.
Search Suffixes
Search Suffixes lets you automatically append a DNS suffix. For example, when you ping “sonicwall” it automatically goes to “sonicwall.engineering.”
To configure Search Suffixes:
1 Click Add to include multiple search suffixes. 2 Check the box next to the Search Suffixes list to remove search Suffixes. 3 Click Delete.
Routes
The Network > Routes page provides configuration procedures to add network routes.

To add a network route:
1 In the NETWORK ROUTES table, click Add.

Analytics CONSOLE Administration

22

Appliance

2 Enter a DESTINATION NETWORK IP address,. 3 Enter the NETWORK MASK/PREFIX. 4 Enter the GATEWAY address. 5 Click Add. 6 Click Cancel to null your choice. 7 To edit the default network route, click the Edit icon under the CONFIGURE column. 8 When multiple network routes are added to the list, selecting the check box at the top left of the page
selects all the added network routes. 9 Click Delete to remove a network route from the list.
NOTE: The default network route cannot be deleted.
Deployment
Use the Deployment command to set various deployment features · Roles (for Syslog-based reporting only) · Settings · Services
Roles
The Deployment > Roles page is divided into two sections: SINGLE SERVER CONFIGURATION and DATABASE CONFIGURATION.

Analytics CONSOLE Administration

23

Appliance

NOTE: The Roles option is only available on the Syslog-based Analytics.
Click Details to see the ROLE DETAILS FOR SONICWALL ANALYTICS, which represents a deployment where all services run on a single server, including the database.

Click Close when finished. The DATABASE CONFIGURATION section provides details of the configuration.

Settings
The Deployment > Settings page is divided into three sections: WEB SERVER SETTINGS, SMTP CONFIGURATION, and SSL ACCESS CONFIGURATION.

Configuring Web Server Settings
1 Enter the HTTP port number in the text field provided. The default port is 80.
If you enter another port in this field, the port number must be specified when accessing the appliance management interface. For example, if port 8080 is entered, the appliance management interface would be accessed with the URL: http://:8080/appliance/.
2 Enter the HTTPS port number in the text field provided. The default port is 443.

Analytics CONSOLE Administration

24

Appliance

If you enter another port in this field, the port number must be specified when accessing the appliance management interface. For example, if port 4430 is entered, the appliance management interface would be accessed with the URL: https://4430/appliance/. 3 Check the box next to Enable HTTPS redirection to redirect HTTP to HTTPS when accessing the firewall interface. 4 Enter the Public IP address in the text field provided. 5 Click Update when you are finished configuring the web server settings. 6 Click Reset to refresh your settings.
Configuring SMTP Settings
The SMTP CONFIGURATION section allows you to configure an SMTP server, an SMTP port, a sender email address, and an administrator email address. You can also test connectivity to the configured server.

To configure the SMTP settings:
1 Type the FQDN or IP address of the SMTP server. 2 Type the SMTP port in the text field provided. The default is 25. 3 Check the box next to Use TLS if you would like to use Transport Layer Security (TLS) for your mail server
connectivity.

Analytics CONSOLE Administration

25

Appliance

4 If you want the SMTP server in your deployment to require authentication, enable the Use Authentication check box. This option is necessary to properly send all outgoing emails to the intended recipients.
5 Enter the User name for authentication in the text field provided. 6 Enter the Password for authentication in the text field provided. 7 Confirm Password in the text field provided. 8 Type the email address from which mail is sent into the Sender address (From) field. 9 Type the email address of the system administrator into the Administrator address (To) field. 10 Enter the number of minutes in the Email send timeout field. The default is 10 minutes. 11 To test connectivity to the SMTP server, click Test Connectivity. 12 To apply your changes, click Update.
Configuring SSL Access
The SSL ACCESS CONFIGURATION section allows you to configure and upload a custom Keystore/Certificate file for SSL access to SonicWall Analytics, or select the default local keystore.
To configure SSL access:
1 Select Default to keep, or revert to, the default settings. This selection allows you to keep the default certificate that comes with the application for use by the SonicWall Analytics Web Server for SSL access. Filename for the keystore used is gmssvpserver.
2 Select Custom to upload a custom keystore certificate for SSL access. This selection allows you to upload a customer certificate for use by the SonicWall Analytics Web Server for SSL access. The original filename of the certificate imported is replaced with gmsvpservercustom in the local file system.
NOTE: The upload can be performed on either of the following ways: · Directly as a certificate: the certificate file (.crt/.cer), its corresponding key file (.key) and the password are required. · Using a keystore: The keystore and the store password are required, which would be converted and stored as a certificate.
3 Under CERTIFICATE UPLOAD section,click Choose File to select your Certificate file.

4 Click Choose File to select your Certificate Key file. 5 Type the password for the certificate file into the Certificate password field. 6 Click View to display details about your keystore certificate. 7 Click Update to submit your changes.

Analytics CONSOLE Administration

26

Appliance

Services
The Deployment > Services page provides a list of the services that are running on your system and their current state. It also provides a way to stop or start any of the services.

Click Details to see the role details for Analytics. To manage a the Host Services, select a service and click Disable, Enable, or Restart.
Flow Agent
The Flow Agent option is only visible for IPFIX-based Analytics. The flow agent collectes data pertaining to applications and transactions in the network infrastructure. It helps give greater visibility to application traffic utilization and performance. The Flow Agent option at CONSOLE > Appliance > Appliance > Flow Agent is the same information displayed at CONSOLE > Flow Agent. This allows you to view flow agent information when in either Appliance mode or CONSOLE mode. For more details about IPM, refer to Flow Agent.
IPM
Intelligent Platform Management (IPM) monitors the performance of system resources like CPU, RAM, and disk space. The IPM option at CONSOLE > Appliance

Appliance > IPM is the same information displayed at CONSOLE > IPM. This allows you to view IPM information when in either Appliance mode or CONSOLE mode. For more details about IPM, refer to IPM

Analytics CONSOLE Administration

27

Appliance

3
Diagnostics
This chapter describes the Debug Log Settings and Summarizer Status that Analytics CONSOLE provides for diagnostics.
Topics:
· Debug Log Settings · Summarizer Status
Debug Log Settings
The Diagnostics > Debug Log Settings page allows you to set debug levels for faster troubleshooting of potential application issues. This action creates debug log files in a single-server deployment. The system has log rotation so the disk does not fill up. Because of the potential performance degradation, you should only set a debug level based on guidance from SonicWall Customer Support. When done debugging, you should reset the debug log settings back to No Debug as soon as the potential issue has been resolved.
NOTE: The higher the debug level, more the system resources are used to generate debug data causing lower the overall system performance. IMPORTANT: The Debug Log Settings are intended for use only under the direction of SonicWall Customer Support.
To set the debug level when instructed by SonicWall Technical Support:
1 Navigate to CONSOLE | Diagnostics > Debug Log Settings.

Analytics CONSOLE Administration

28

Diagnostics

2 Select one of the following from the System Debug Level drop-down list: · No Debug · Level 1 (Codepath) · Level 2 (Simple) · Level 3 (Logic) · Level 4 (Detailed) · Level 5 (Highly Detailed)
The No Debug level setting provides no debug information, and the Level 5 (Highly Detailed) setting provides the maximum debug information. 3 Click Update to make your changes. 4 Click Reset to start again. Be sure to reset the level to No Debug for normal operation as soon as the potential issue has been resolved.
Summarizer Status
The Summarizer Status option is only available on Syslog-based Analytics. The Diagnostics > Summarizer Status page allows you to see your activity for the past seven days:

NOTE: The average load and estimated capacity are specific to the deployment and could vary across systems.
Sections of the Summarizer Status page can be expanded to see more information: · Summarizer Details · Syslogs Details

Analytics CONSOLE Administration

29

Diagnostics

Summarizer Details
Click the down arrow next to Details for Summarizer. Several other section are also expanded and show related information:
· SUMMARIZER UTILIZATION · DATA FILE INFORMATION · SUMMARIZER PROCESS DETAILS · OPTIMIZATION INFORMATION

Analytics CONSOLE Administration

30

Diagnostics

Syslogs Details
Click the down arrow next to Syslogs sent by appliances that are under Reporting and Management to see more information. The two subsections are:
· SERIAL # OF APPLIANCES FOR SUMMARIZER AT
· SERIAL # OF APPLIANCES THAT ARE MISCONFIGURED
NOTE: Log in to the appliance and disable the syslogs. If you do not have access to the appliance, use the rules to the gateway to block the serial numbers. To fix the misconfigured serial numbers, log in to the appliance and change the GMS settings. The serial numbers are listed in the settings and are updated every 12 hours.

Analytics CONSOLE Administration

31

Diagnostics

4
3rd Party
The 3rd Party command option is available only for IPFIX-based Analytics. The 3rd Party command provides the means for new API keys and managing the key assignments.
Key Assignments
The default view is the Key Assignments tab. All key assignments are listed here along with time of creation, time to live and the actual key. You can select any key or set of key and delete them.

Generating a New Key
To generate a new key:
1 Navigate to CONSOLE > 3rd Party > API Keys. 2 Select the Generate New Key tab.

3 Typer Username in the field provided.

Analytics CONSOLE Administration

32

3rd Party

4 In the TTL (Time to Live) field, enter the number of days you want the key to be active. 5 Click Update.

Analytics CONSOLE Administration

33

3rd Party

5
Flow Agent
The Flow Agent option is only visible for IPFIX-based Analytics. The flow agent collects data pertaining to applications and transactions in the network infrastructure. It helps give greater visibility to application traffic utilization and performance. The Flow Agent option at CONSOLE > Flow Agent is the same information displayed at CONSOLE > Appliance > Appliance > Flow Agent. This allows you to view flow agent information when in either Appliance mode or CONSOLE mode.
Topics:
· Devices · Statistics · Usage · Monitor · Process Monitor · Log · Settings
Devices
Navigate to CONSOLE > Flow Agent > Devices to see a list of all the devices that are being monitored by IPFIX-based Analytics. The top of the table shows some basic statistics like AppFlow Server Uptime, System Uptime and Last Update. The Devices table provides many different details about each device listed. The Device table can be searched to find a specific device and it can be refreshed to update the data in the table. NOTE: The DATA RETENTION (DAYS) column in the DEVICES list displays the number of days Analytics will retain the data for the particular device.

Analytics CONSOLE Administration

34

Flow Agent

Statistics
The Statistics page, found at CONSOLE > Flow Agent > Statistics, is a list of different kind of statistics collected on various parameters.

Choose from the tabs across the top to see different types of statistics: System, IPFIX, or Template.

Analytics CONSOLE Administration

35

Flow Agent

Usage
The Usage page shows the statistics for the key system resources: Memory Usage, Disk Usage, and DB (Database) Size. For memory and disk usage, used space, free space and total space are displayed in a bar chart. Current size and maximum are shown for database size.
The charts on this page can be minimized by clicking on the blue minus icon on the upper right corner of each chart. Click the blue plus icon to expand the chart.

Monitor
The Monitor page shows the statistics for IPFIX and the CPU. At the top of the table, you can set the frequency of the monitoring. The preset time periods range from 60 second to 10 minutes. You can also designate how frequently the data refreshes, in seconds. The three data types being monitored include:
· IPFIX RECORD RATE · IPFIX PACKET RATE · CPU MONITOR The charts on this page can be minimized by clicking on the blue minus icon on the upper right corner of each chart. Click the blue plus icon to expand the chart.

Analytics CONSOLE Administration

36

Flow Agent

Process Monitor
Navigate to CONSOLE > Flow Agent > Process Monitor to see the page that shows the list of processes being monitored. It also shows the process status. At any time, you can click the Refresh button to update the process status.

Analytics CONSOLE Administration

37

Flow Agent

Log
Navigate to CONSOLE > Flow Agent > Log to see the various logs that have been captured. At any time, you can click the Refresh button to update the log status.

Settings
The Statistics page, found at CONSOLE > Flow Agent > Settings, is a list of different kind of settings defined for various flow agent parameters.

Choose from the tabs across the top to see different types of setting: File Locations or Collector Settings.

Analytics CONSOLE Administration

38

Flow Agent

6
IPM
Intelligent Platform Management (IPM) monitors the performance of system resources like CPU, RAM, and disk space.
Topics:
· Settings · Monitor · History
Settings
The IPM > Settings page lets you set the THRESHOLD SETTINGS for the following: · CPU/Processor · Memory/RAM · Storage/Disk · Estimated Capacity · Capacity Estimation Settings
For most settings you can set a medium severity and a high severity for each threshold. (Click Apply or Reset for each change you make.) For the capacity estimation settings you can Enforce Disk Capacity Estimation by checking the box and applying the setting.

Analytics CONSOLE Administration

39

IPM

CPU/Processor
To set the CPU/Processor setting:
1 Move the slider icon between 60 and 80% of severity level to set your Medium preference. 2 Click Apply or Reset. Your choice is shown next to the Reset button. 3 Move the slider icon between 85 and 95% of severity level to set your High preference. 4 Click Apply or Reset. Your choice is shown next to the Reset button.

Analytics CONSOLE Administration

40

IPM

Memory/RAM
To set the Memory/RAM setting:
1 Move the slider icon between 60 and 80% of severity level to set your Medium preference. 2 Click Apply or Reset. Your choice is shown next to the Reset button. 3 Move the slider icon between 85 and 95% of severity level to set your High preference. 4 Click Apply or Reset. Your choice is shown next to the Reset button.
Storage/Disk
To set the Storage/Disk setting:
1 Move the slider icon between 50 and 75% of severity level to set your Medium preference. 2 Click Apply or Reset. Your choice is shown next to the Reset button. 3 Move the slider icon between 80 and 95% of severity level to set your High preference. 4 Click Apply or Reset. Your choice is shown next to the Reset button.
Estimated Capacity
To set the Estimated Capacity setting:
1 Move the slider icon between 50 and 75% of severity level to set your Medium preference. 2 Click Apply or Reset. Your choice is shown next to the Reset button. 3 Move the slider icon between 80 and 95% of severity level to set your High preference. 4 Click Apply or Reset. Your choice is shown next to the Reset button.
Capacity Estimation Settings
1 Click the box next to Enforce Disk Capacity Estimation for your configuration. 2 Click Apply when done.
Monitor
The IPM > Monitor page gives you the SYSTEM RESOURCE REAL-TIME MONITOR table which features real-time interactive line charts for CPU/PROCESSOR, MEMORY/RAM, and STORAGE/DISK. Use the charts to get important data for each system component being monitored. All three charts have two upper-control level lines starting at 75% of utilization for Warning and 90% of utilization for Critical thresholds.

Analytics CONSOLE Administration

41

IPM

To use the CPU/Processor chart:
1 Hover over the chart to select the data you want to plot. 2 The chart distributes the category data (a 10-second time interval) along a horizontal axis and the
numerical percentage Utilization (%) value data along a vertical axis. 3 Select the blue line on the chart to see the User data. 4 Select the green line on the chart to see the I/O Wait data. 5 Select the yellow line on the chart to see the System data.
To use the Memory/RAM and Storage Disk charts:
1 Hover over the charts to select the data you want to plot. 2 The chart distributes the category data (a 10-second time interval) along a horizontal axis and the
numerical percentage Utilization (%) value data along a vertical axis. 3 Select the blue horizontal bars on the chart to see the Used data. 4 Select the yellow horizontal bars on the chart to see the Free data.

Analytics CONSOLE Administration

42

IPM

History
The IPM > History page gives you the HISTORICAL DATA VIEW of your CPU/PROCESSOR and MEMORY/RAM. You can see the data time period by choosing the PAST 24 HRS, PAST 3 DAYS, and PAST 5 DAYS from the drop-down menu. The CPU/Processor and Memory/RAM data is displayed in two real-time interactive line and bar charts, respectively. Use the charts to get important data for each system component being monitored. Both charts have two upper-control level lines starting at 75% of utilization for Warning and 90% of utilization for Critical thresholds.
To use the CPU/Processor chart:
1 Hover over the chart to select the data you want to plot. 2 The chart distributes the category data (a three-hour time interval) along a horizontal axis and the
numerical percentage Utilization (%) value data along a vertical axis. 3 Select the blue line on the chart to see the User data. 4 Select the green line on the chart to see the I/O Wait data. 5 Select the yellow line on the chart to see the System data.
To use the Memory/RAM chart:
1 Hover over the charts to select the data you want to plot. 2 The chart distributes the category data (a three-hour time interval) along a horizontal axis and the
numerical percentage Utilization (%) value data along a vertical axis. 3 Select the blue horizontal bars on the chart to see the Used data. 4 Select the yellow horizontal bars on the chart to see the Free data.

Analytics CONSOLE Administration

43

IPM

7
Notifications
The Notifications option is only visible for IPFIX-based Analytics. These settings define the parameters for the alerts and notifications. Navigate to CONSOLE > Notifications > Settings to see the options. The Settings view is broken into the following sections:
· Global Alert · Mail Group
Global Alert
To enable or disable Alerts and Notifications:
1 Go to Notifications > Settings.

2 Toggle Enable Alerts and Notifications. A green switch indicates that the option is enabled. The gray switch indicates that the option is disabled. NOTE: By default, the Enable Alerts and Notifications switch is enabled.
NOTE: This action affects all the firewalls on this setup.

Analytics CONSOLE Administration

44

Notifications

3 Click OK to acknowledge the message that the Global Alert has been changed.
Mail Group
MAIL GROUP settings are configured by administrators to set the email parameters so your network infrastructure can sent email reports, alarm notifications, and so on. There are two tabs to work with in the MAIL GROUP table:
· Email Lists · Email Group.

Configuring Email

You can configure your Email Lists settings by working with the EMAIL ID and CONFIGURE columns in the Email Lists tab. You can use the Edit and Delete icons for your email addresses.

Email Lists Options

Option Search Emails
Refresh Emails Add Email Delete Email

Description Allows you to look for specific email addresses you have added to create your alerts. Allows you to update your email address list. Allows you to add an email address using email ID settings. Allows you to delete one or many email address es listed in the Email ID column.

Analytics CONSOLE Administration

45

Notifications

Editing Email Lists
1 Click the check boxes next the EMAIL ID you want to edit. 2 Click the Edit icon to access the EMAIL ID SETTINGS dialog box. 3 Modify the Previous Email Id by entering a new email address in the Changed Email Id text field. 4 Click Next. 5 Check that the correct email address is displayed under the SUMMARY text field next to Email Group
Name and then click Create. 6 Click Close after you have successfully changed the email address.
Deleting Email Lists
1 Click one or more of the check boxes under the EMAIL ID column to indicate the email addresses you want to delete.
2 Click the Delete icon. 3 Click OK in the dialog box to confirm your deletion. 4 Click OK in the confirmation message to finish deleting the email address.
Configuring an Email Group
The view under the Email Group tab is different than the view under the Email Lists tab. You can configure your Email Group settings by working with the EMAIL GROUP and CONFIGURE columns in the Email Group tab. You can use the Edit and Delete icons to configure your email addresses.

Adding an Email Group
To add an Email Group:
1 Click the Email Group tab. 2 Click the + icon at the top right of the Mail Group table.

Analytics CONSOLE Administration

46

Notifications

3 In the EMAIL GROUP SETTINGS dialog screen, type the Email Group Name for your email group. 4 Check the boxes next to the email addresses that you want included in your email group. 5 Click Next.

6 Review your settings in the SUMMARY section. 7 Click Create to proceed or Previous to adjust your settings.

Analytics CONSOLE Administration

47

Notifications

8 Click Close after you have successfully created your email group.
Editing an Email Group
1 Click the Email Group tab. 2 Click the check box next the email group, under the EMAIL GROUP column, to indicate the email address
of the group you want to edit. 3 Click the Edit icon to access the EMAIL GROUP SETTINGS dialog box. The EMAIL GROUP SETTINGS dialog
displays. 4 Edit or enter a new Email Group Name for your group of email addresses. 5 Optionally, check the boxes of the email addresses you want to include or exclude in the group. 6 Click Next. 7 Check that the correct name for the group of email addresses is displayed under the SUMMARY text field
next to Email Group Name. 8 Click Create. 9 Click Close after you have successfully changed the name of the group for your email addresses.
Deleting an Email Group
1 Click the Email Group tab. 2 Click one or more of the check boxes, under the EMAIL GROUP column, to indicate the groups of email
addresses you want to delete. 3 Click the Delete icon. 4 Click OK in the dialog box that displays to confirm your deletion. 5 Click OK in the dialog box that displays to finish deleting the name for your group of email addresses.

Analytics CONSOLE Administration

48

Notifications

8
Log
Logs help track activities in the system. These activities are associated, either directly or indirectly, with user-initiated actions or based on system- initiated actions. These logs are important support for audit trails and compliance purposes, as well as for troubleshooting system operation.
Topics:
· Configuration · View Log
Configuration
The Log > Configuration page lets you manually delete logs that no longer need to be stored in the system. This is a one-time action and is executed based on the date selected for deletion.

To delete Analytics log messages:
1 Under the heading DELETE SONICWALL ANLYTICS LOG MESSAGES, select the deletion date from the drop-down menu for month, day, and year next to Delete Logs Older Than.
2 Select the location for the logs in the drop-down menu next to for. You have two choices: All Domains and LocalDomain.
3 Click Update when done.

Analytics CONSOLE Administration

49

Log

To archive Analytics log sessages:
Logs that no longer require to be stored in the system can be exported in CSV or HTML format and be offloaded from the database. The archive process first archives the data to archivedLogs directory as per Archive Log Schedule and the data is then deleted from the database.
NOTE: For non-window deployments: to offload the archived log files to the local drive, navigate to the Appliance > Systems > File Manager screen.
1 Under the ARCHIVE SONICWALL ANALYTICS LOG MESSAGES, click the check box next to Enable Archive to store your logs.
2 Choose the number of months you want to Archive SonicWall Analytics Log Messages for from the drop-down list. You can archive your log messages for up to 12 months.
3 Choose the Maximum Log Message Files to be archived in the archivedLogs folder from the drop-down list. You can store a maximum of 99 files.
4 Delete your data by setting the day and time of your deletion using the drop-down menu next to Delete Data Every.
5 Choose your file Archive Format by clicking on the radio buttons for CSV or HTML. 6 Click Update when done.
View Log
The Log > View Log page tracks changes made from the user interface, logins, failed logins, logouts, password changes, scheduled tasks, failed tasks, completed tasks, raw syslog database size, syslog message uploads, and time spent summarizing syslog data.
To view the log:
1 Scroll down to the SEARCH RESULTS section. Each log entry contains the following fields: · DATE–specifies the date of the log entry. · MESSAGE–contains a description of the event. · SEVERITY–displays the severity of the event (Alert, Warning, or Info). · FIREWALL NAME–specifies the name of the SonicWall appliance that generated the event (if applicable). · SONICWALL ANALYTICS USER–identifies the user role. · USER IP–specifies the user name and IP address.
You can also sort the SEARCH RESULTS. Click on any one of the column headings to sort the table descending or ascending based on the column heading. 2 Enter any number between 10 and 100 in the Messages Per Screen field to set number results shown per page. 3 Click Apply. 4 Click Next to view more.

Analytics CONSOLE Administration

50

Log

To search the results:
TIP: You can press Enter to navigate from one element to the next in this section.
1 In the SEARCH CRITERIA section, use the following fields, as needed, to refine your search: · Select Time of logs (From and To)–Select from and to date to find the log entries created during the time. · SonicWall Node–displays all log entries associated with the specified SonicWall appliance that you list. · Message contains–enter any text find the events relevant to the text. · Severity–select the severity level of the log. Your options are: · All (Alert, Warning, and Info) · Alert and Warning · Alert · Select Match case to make the SonicWall Node and Message contains search fields case sensitive. · Select one of Exact Phrase, All Words, or Any Word to customize your search.
2 Click Start Search. 3 To clear all values from the input fields and start over, click Clear Search.

Analytics CONSOLE Administration

51

Log

4 To download the results as an HTML file on your system, click Export Logs and download the file to your computer.

Analytics CONSOLE Administration

52

Log

9
Management
This chapter describes the settings available in the CONSOLE | Management section.
Topics:
· General · Sessions
General
On the Management > General page, you can change your password and configure your on-premises Analytics miscellaneous settings.

Changing your Password
To change your password:
1 Enter your Current Password in the text field provided. 2 Enter your New Password in the text field provided. 3 Confirm New Password in the text field provided.

Analytics CONSOLE Administration

53

Management

Enabling Two-Factor Authentication
Two-factor authentication is an electronic authentication method which allows user to set an additional layer of security while to prevent unauthorized access to Analytics. To enable two-factor authentication for Analytics:
1 Click on the Enable 2FA box under the Management > General page.
2 Re-login to Analytics using your user name and password. you will be directed to the 2FA page where the SonicWall-proprietary bar code screen will be displayed.

3 Scan the bar code using Google or Microsoft authenticator to get the 6-digit one-time password.
4 Enter the password in the box to successfully login to Analytics.
IMPORTANT: Remember to write down your eight-digit emergency code somewhere for later access as it is the only way to log in if you lose your mobile phone.

Analytics CONSOLE Administration

54

Management

5 When you login for any subsequent time, you will be directed to the 2FA page where You need to enter the password generated from the authenticator.

IMPORTANT: If you have lost the device where the authenticator is installed or you have forgotten the emergency code, then you can login by mailing the password to the email address which is configured in Analytics. You can then re-enable the 2FA feature on the Management page and follow the same steps as above to generate a new bar code and emergency code.

IMPORTANT: You can disable the 2FA feature by unchecking the 2FA box on the Management page.

Configuring the Miscellaneous Settings

To configure the miscellaneous settings:
1 Under MISCELLANEOUS SETTINGS, set the Inactivity Timeout in the field provided. The time should be stated in minutes. An entry of -1 means the system never times out.
2 Set the number of rows that appear in non-reporting related paginated screens in Max Rows Per Screen. The value can range from 10 to 100.
3 Define the Auto Save Dashboard Settings. The value can range from 1 to 60. An entry of -1 means the auto save is not enabled.
4 To configure what you want to see on the Appliance Selection Panel, Show enable or disable the following:
· Select Icons, Text, or Icons and Text (default)
· Check one of the following:
· Enable Audio Alarm when a Managed Unit goes Up
· Enable Audio Alarm when a Managed Unit goes Down

Analytics CONSOLE Administration

55

Management

5 To configure the Message of the Day: a Click on View Message of the Day. b Disable the Message of the Day by checking the box Don’t display message when logging in. c Click Close.
6 Click Update to save the new settings.

Sessions
The Management > Sessions page allows you to view session statistics for currently logged in users and to end selected sessions. The CURRENT SESSIONS table has the Delete, USER NAME, IP ADDRESS, LOGIN TIME, LAST ACCESS TIME, and DOMAIN NAME columns.
To end a session:
1 Check the box next to any active session to end it. You can delete more than one session. 2 Click End selected sessions at the bottom right of the table.

Analytics CONSOLE Administration

56

Management

Analytics CONSOLE Administration

57

Management

10
Reports
The Reports option is only visible for Syslog-based Analytics. These settings define the parameters for the various reports provided. Navigate to CONSOLE > Reports to see the options.
Topics:
· Summarizer · Syslog Filter · Email/Archive · Scheduled Reports · Archive
Summarizer
The Reports > Summarizer page provides several sections to help manage your reports. The sections are:
· DATA DELETION SCHEDULE · DATA STORAGE CONFIGURATION · PRIVATE IP HOSTNAME RESOLUTION CONFIGURATION · PUBLIC IP HOSTYNAME RESOLUTION CONFIGURATION · SYSLOGS SENT BY APPLIANCES THAT ARE NOT UNDER REPORTING AND MANAGEMENT · SYSLOG DATA FILE SIZE CONFIGURATION · MINIMUM DISK SPACE CONFIGURATION · PACKET DATA VIEWER CONFIGURATION

Analytics CONSOLE Administration

58

Reports

To set your data deletion schedule:
1 Choose the day and the time when you want your data deleted from the drop- down menu next to Delete Data Every.
2 Click Update when done.
To set your data storage configuration schedule:
1 Choose the IP address from the drop-down menu next to Summarizer at. 2 Select how long you want your data stored for from the drop-down menu next to Keep Reporting Data
for. The choices are between one and 36 months. 3 Select how long you want your raw syslog data files stored for from the drop-down menu next to Keep
Raw Syslog Data Files for. The choices are between one and 36 months. 4 Click Update when done.

Analytics CONSOLE Administration

59

Reports

To set your private hostname resolution configuration:
1 Check the box next to Enable Reverse Hostname Resolution. 2 Choose to Refresh Resolved Hostname Cache every XX minutes. This is the time duration for which the
hostname is cached to a particular IP address. 3 Choose to Scan every xx minutes. This is the time intervals at which the lookup is triggered. 4 Choose to Lookup the thread count. This is the number of threads that will be processing the resolution. 5 Click Update when done.
To set your public hostname resolution configuration:
1 Check the box next to Enable Public IP Hostname Resolution. 2 Choose the Time out value for Resolution in XX milliseconds. 3 Click Update when done.
To store your syslog reports:
1 Check the box next to Store Syslogs. 2 Click Update when done.
To store your syslog messages per file:
1 Enter the Number of syslog messages per file you want to keep. The default number is 10,000. 2 Click Update when done.
To set your minimum disk space configuration:
1 Choose the Minimum % of disk space that should be free for Syslog Collector to consume syslogs:. The disk space choices in the drop-down menu range from default to 10, 15, 20, and 25 percentage. Default sets it at 5GB minimum disk space required.
2 Click Update when done.
To set your packet data viewer configuration:
1 Check the box next to Enable Packet Data Viewer. 2 Click Update when done.

Analytics CONSOLE Administration

60

Reports

NOTE: Changes to Data Deletion Schedule and Data Storage Configuration take effect after the current run. Report data older than current month + Number of month to keep are deleted. It is recommended that the Data Deletion Schedule be configured to run after the data has been backed up. Navigate to Appliance

System > Backup/Restore to review the current backup schedule. Enabling Private IP Hostname lookup increases the time taken to process syslogs. All syslogs that need resolution are processed separately in parallel to normal syslog processing. This might slow down the summarizer, increase memory and consume more CPU cycle. Also, the memory and CPU are impacted further by changing the default configurations of Lookup thread count, Scan every, and Refresh Resolved Hostname Cache every. Any changes to Hostname Resolution Configuration take effect during the next summarizer run. Syslog Collector needs to be restarted for the changes to Minimum Disk Space Configuration to take effect. If the free disk space falls below this value, Syslog Collector stops listening for syslogs. Changes to Syslog Data File Size Configuration reflects the number of syslog messages per .src file in the syslogs directory. Setting the Minimum Disk Space percentage to Default sets it to 5GB minimum disk space required.
Syslog Filter
The Reports > Syslog Filter page gives you access to the Syslog Exclusiong Filters, which you can apply to the syslogs uploaded to the reporting database. All syslogs continue to be stored in the file system without any filtering. Exclusion filter settings are picked up the summarizer every: 00 hour(s):15 min(s). To add/modify a Syslog Exclusion Filter at the unit level, navigate to Firewall/SRA > Unit Level > Reports > Filter Settings. The Syslog Filter table features the STATUS, SYSLOG FIELD NAME, OPERATOR, SYSLOG FILTER VALUE, LEVEL, COMMENT, GMS USER, and CONFIGURE columns.
NOTE: Only a super administrator, also known as a Super Admin, can edit, add, and delete a filter.
To add, delete, or enable/disable a syslog filter:
1 Check the box next to the filter you want to manage. 2 Click the Add, Delete, or Enable/Disable buttons at the bottom of the table. To access the Scheduled Reports page in Syslog Reports, click the CONSOLE button, next to REPORTS, in the top navigation menu. The view changes immediately to the Log > View Log default page. Click Reports > Scheduled Reports to set up or change the reports you want generated on a regular basis.

Analytics CONSOLE Administration

61

Reports

Email/Archive
The Reports > Email/Archive page has three sections to allow you to manage your reports. The sections are: · EMAIL/ARCHIVE TIME SETTINGS · LOGO SETTINGS · USER TIMEOUT CONFIGURATION · SORT BY SETTINGS IN PDF REPORTS

Analytics CONSOLE Administration

62

Reports

To set your email and archive settings:
1 Choose your Next Scheduled Email/Archive Time (mm/dd/yyy hh:min) by specifying the date in the text field provided and the hour of the day and minutes from the drop-down menus.
2 Choose the day of the week you want to Send Weekly Reports Every from the drop-down menu. 3 Choose the day of the month you want to Send Monthly Reports Every from the drop-down menu. You
can choose to send your email/reports between the first and the last day (31) of the month. 4 Click the Update buttons next to each of the choices above.
NOTE: Weekly reports are generated for Monday-Sunday of the week and Monthly Reports are generated for the 1-30/31 of the month.
To set your logo settings:
1 Click Choose File next to Logo File. 2 Click Update when done.
To set your timeout configuration:
1 Choose your Time out Value up to 120 minutes, which is the default. 2 Click Update when done.
To sort by settings in the PDF reports:
1 Check the radius button for either MBytes or Hits/Connections/Events. 2 Click Update when done.
Scheduled Reports

Topics:
· Managing the Reports · Navigating the Schedules Page
· Setting Up the Reports in Analytics Syslog · Checking the Reports · Setting the Report Date Range

Analytics CONSOLE Administration

63

Reports

Managing the Reports
Several icons at the top right corner of the Scheduled Reports table help you manage your reports. Some restrictions and limits are enforced, and a few additional steps are involved while creating a group-level Scheduled Report. Refer to the image and table below to learn more about them.
NOTE: A maximum of 10 schedules are allowed to be created for a single group.

Scheduled Reports icons

Icon

Description

Allows you to refresh the data.

Allows you to archive your report when you click on the icon.

Allows you to archive your report for the specific date range you define.
Allows you to delete scheduled reports.

Allows you to create a scheduled report.

Navigating the Schedules Page
Go to Reports > Scheduled Reports to view a list of all the scheduled reports that have been defined. The details of each report are shown in the table.

Click the search icon at the top left of the table to search for a specific report. As you type characters in the field, the table filters accordingly. To clear the filter, delete the characters.
· Click SCHEDULE NAME to see details about the report schedule. · Click ID to see the number associated with a report. · Click SCHEDULE TYPE to sort the schedules. · The icons in the ARCHIVE/EMAIL column indicate whether the report is set up for archiving or emailing,
or both. This parameter can be changed by clicking the Edit icon. · Click EMAIL SUBJECT to sort by email subject. · Click OWNER to sort by owner. · Click LAST RUN TIME to sort by the time the schedule was last executed. · Click STATUS to see whether the report was successfully run or not. · Click ACTIONS to Edit or Delete a report.

Analytics CONSOLE Administration

64

Reports

Setting Up the Reports in Analytics Syslog
To set up a scheduled report in an Analytics 2.5 syslog system:
1 At the top right of the Scheduled Reports table, click on the icon to Create a Schedule Report. 2 Under TASK INFO, type the Schedule Name. 3 Select the Schedule Interval. You can choose Daily, Weekly, and Monthly. The default time interval is
Daily. 4 Check Email if you want the report emailed directly to someone and provide the email address in the
field that appears. 5 Check Archive if you want the report stored locally.
NOTE: You can select both the Email and the Archive options.
6 Under FORMAT/SETTINGS, select the Report Language. 7 Select the Row Count from the drop-down list. You can choose between 5, 10, 20, and 50. 8 Select the Report Format in either PDF or XML files. 9 Check the box for a Zip Report and/or Password protect it.

10 Click Next. 11 Select one of the views from the drop-down list. You can choose from GlobalView, FirmwareView,
ModelView, or InstanceView. 12 Click the DEVICE you want. 13 Click Next.

Analytics CONSOLE Administration

65

Reports

14 Search Templates next to the small search icon. 15 Check the box for the report you want. You can Select All or select individual reports. 16 Your choices appear under the SELECTED REPORTS section. 17 Click Next.

18 Under COVER PAGE SETTINGS, select your Cover logo from the drop-down list or Upload a logo by clicking Choose File.
19 Enter your Cover Title in the text field provided.
20 Click Next.

Analytics CONSOLE Administration

66

Reports

21 Check your PERMISSION SETTINGS, your SELECTED REPORTS, and click Next.

22 Review your SCHEDULE DETAILS, your SELECTED REPORTS, and click Create.

Analytics CONSOLE Administration

67

Reports

23 After your Schedule creation has been successful a screen appears with your SCHEDULE DETAILS and SELECTED REPORTS.
24 Click Close when done.

Analytics CONSOLE Administration

68

Reports

Checking the Reports
After you have created your reports, you can check on them by clicking the check boxes next to them. You can also check if your configurations have been saved and are scheduled as you have planned.
1 Navigate to CONSOLE | Scheduled Reports | SCHEDULE NAME column. 2 Check the box next to the name of your report. 3 Click the Archive Now icon at the top right of the table.
4 Click Submit.
5 Click Close.

Analytics CONSOLE Administration

69

Reports

Setting the Report Date Range
1 Check the box next to your report SCHEDULE NAME. 2 Then, click the Archive for date range icon at the top right of the table to select your date range. 3 Click in the Start Date and End Date fields to select your preferred dates. 4 Click Submit.

Analytics CONSOLE Administration

70

Reports

Archive
The Reports > Archive page gives you access to the Archived reports, which you can search for in the reporting database. All archived reports continue to be stored in the file system until you delete them. The Archive r table features the SCHEDULE NAME, FORMAT, SOURCE, TRIGGER, GENERATION TIME, START TIME, END TIME, and ACTION columns.
To download or delete your archived reports:
1 Check the box next to the archived report you want to download or delete. 2 Click the Download or Delete icons under the ACTIONS column for the row you selected.

Analytics CONSOLE Administration

71

Reports

11
Licenses
The Licenses > Product Licenses page allows the user to view, upload, and manage licenses and subscriptions for this implementation.
Topics:
· License Summary · Managing Licenses · Refreshing Licenses · Uploading a License
License Summary
View license details on the CONSOLE | Licenses > Product Licenses page, under the LICENSE SUMMARY section. You can view the following information:
· Last date and time THE SonicWall license registration was contacted · The serial number for the firewall being monitored. · Security Service information: if licensed, the license capacity and the expiration date · Support Service information:
· Analytics E-Class 24×7 Software Support
Managing Licenses
Your MySonicWall account is a one-stop resource for registering all your SonicWall security appliances and managing all your SonicWall security service upgrades and changes. MySonicWall provides you with an easy to use interface to manage services and upgrades for multiple SonicWall appliances.
To manage licenses:
1 Click Manage. 2 Enter your MySonicWall username/email address. 3 Enter your Password. 4 Click Login. 5 If you forgot your username and password, click Return to License Summary.

Analytics CONSOLE Administration

72

Licenses

Refreshing Licenses
This feature allows you to synchronize Management services with the MySonicWall license server. Synchronization is useful if you have recently purchased new licenses, and these licenses are not yet appearing in the summary page. Click Refresh. The License Summary page notes that the refresh completed successfully, and the date of the last contact changes to reflect the new date and time.
Uploading a License
Normally, MySonicWall communicates with your Management service to synchronize licenses automatically. The manual upload feature is useful if for some reason your unit is without Internet connectivity.
To manually upload a license:
1 Click Upload. 2 Click Choose File to search for your locally stored license file.
NOTE: License files for manual updates are available for download through your MySonicWall account.
3 Click Upload to complete the license transfer.

Analytics CONSOLE Administration

73

Licenses

12
SonicWall Support
Technical support is available to customers who have purchased SonicWall products with a valid maintenance contract and to customers who have trial versions. The Support Port232-005164-00 Rev D232-005164-00 Rev Dal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. To access the Support Portal, go to https://www.sonicwall.com/support. The Support Portal enables you to:
· View knowledge base articles and technical documentation · View video tutorials · Access MySonicWall · Learn about SonicWall professional services · Review SonicWall Support services and warranty information · Register for training and certification · Request technical support or customer service To contact SonicWall Support, visit https://www.sonicwall.com/support/contact- support.

Analytics CONSOLE Administration

74

SonicWall Support

About This Document
Legend
WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death.
CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed.
IMPORTANT, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information.
SonicWall Firewall Management CONSOLE Administration Guide Updated – October 2023 232-005164-00 Rev D
Copyright © 2023 SonicWall Inc. All rights reserved.
SonicWall is a trademark or registered trademark of SonicWall Inc. and/or its affiliates in the U.S.A. and/or other countries. All other trademarks and registered trademarks are property of their respective owners The information in this document is provided in connection with SonicWall Inc. and/or its affiliates’ products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of SonicWall products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, SONICWALL AND/OR ITS AFFILIATES ASSUME NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL SONICWALL AND/OR ITS AFFILIATES BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF SONICWALL AND/OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SonicWall and/or its affiliates make no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. SonicWall Inc. and/or its affiliates do not make any commitment to update the information contained in this document. For more information, visit https://www.sonicwall.com/legal. End User Product Agreement To view the SonicWall End User Product Agreement, go to: https://www.sonicwall.com/en- us/legal/license-agreements. Open Source Code SonicWall is able to provide a machine-readable copy of open source code with restrictive licenses such as GPL, LGPL, AGPL when applicable per license requirements. To obtain a complete machine-readable copy, send your written requests, along with certified check or money order in the amount of USD 25.00 payable to “SonicWall Inc.”, to:
General Public License Source Code Request SonicWall Inc. Attn: Jennifer Anderson 1033 McCarthy Blvd Milpitas, CA 95035

Analytics CONSOLE Administration

75

SonicWall Support

References

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>

Related Manuals