Events Settings

The following section describes how to configure the Events Settings in the PCE web console.

Events Are Always Enabled

Events are enabled by default in the PCE and cannot be disabled, in accordance with Common Criteria compliance.

Use the PCE web console to change event-related settings and the PCE runtime_env.yml for traffic flow summaries.

Event Settings in PCE Web Console

From the PCE web console, you can change the following event-related settings:

  • Event Severity: Sets the severity level of events to record. Only messages at the set severity level and higher are recorded. The default severity is “Informational.”
  • Retention Period: The system retains event records for a specified number of days; from 1 day to 200 days with the default period being 30 days.
  • Event Pruning: The system automatically prunes events based on disk usage and the age of events; events older than the retention period are pruned. When pruning is complete, the system_task.prune_old_log_events event is recorded.
  • Event Format: Sets the message output to one of the three formats. The selected message output format only applies to messages that are sent over syslog to a SIEM. The REST API always returns events in JSON.

    • JavaScript Object Notation (JSON): The default; accepted by Splunk and QRadar SIEMs

    • Common Event Format (CEF): Accepted by ArcSight

    • Log Event Extended Format (LEEF): Accepted by QRadar

Event Severity Levels

Severity Description
Emergency System is unusable
Alert Should be corrected immediately
Critical Critical conditions
Error Error conditions
Warning Might indicate that an error will occur if action is not taken
Notice Events that are unusual, but not error conditions
Informational Normal operational messages that require no action
Debug Information useful to developers for debugging the application

Output Format Change

The output format can be changed in the PCE web console:

  • JSON (default)
  • CEF
  • LEEF

Records are in JSON format until you change to one of the other formats. Then, the new events are recorded in the new format; however, the earlier events are not changed to the selected format and they remain recorded in JSON.

Set Event Retention Values

You can set the event retention values depending on the specific conditions described below.

If you are using a SIEM, such as Splunk as the primary long-term storage for events and traffic in a dynamic environment, consider setting the event retention period to 7 days. On setting it to 7 days, you can use the PCE Troubleshooting or Events Viewer to quickly troubleshoot and diagnose events. The benefit of setting 7 days is that if an issue occurs on a Friday, it can still be diagnosed on the following Monday. A large number of events are generated in a dynamic environment, which increases the data stored (disk space used), backup size, and so on. The period of 7 days provides a good balance between disk usage and the ability to troubleshoot.

NOTE:

A dynamic environment is when applications and infrastructure are subject to frequent changes; for example, usage of APIs, ETL, Containers, and so on.

If you are using a SIEM in a non-dynamic environment, consider setting the event retention period to 30 days. A smaller number of events are generated, and less disk space is used in a non-dynamic environment.

If you not using a SIEM such as Splunk and the PCE is the primary storage for the events data used for reporting, diagnosis, and troubleshooting, set the event retention period as per the organization's record retention policy, for example 30 days. If you generate quarterly reporting using events, set the event retention period to 90 days.

SIEM Consideration Value

Yes: Primary storage for events

 If primary storage of events is not on the PCE 7 days (PCE troubleshooting) 1 day (minimum)
No: Not primary storage for events If primary storage of events is on the PCE, consider the organization’s record retention policy as well as the available disk and event growth pattern 30 days (default)
No
  • If the organization's record retention is more than 30 days
  • If disk monitoring is not set up, it is required to set up disk monitoring

As per your record retention policy

200 days (maximum)
Not applicable If events data is not needed for reporting or troubleshooting 1 day (minimum)

If disk space availability and event growth projections indicate that the desired retention period cannot be safely supported, consider using a SIEM because the PCE might not store events for the desired period.

NOTE:

Running the illumio-pce-db-management events-db command provides an output of the average number of events and the storage used.

Configure Events Settings in PCE Web Console

  1. From the PCE web console menu, choose Settings > Event Settings to view your current settings.
  2. Click Edit to change the settings.

    • For Event Severity, select from the following options:

      • Error

      • Warning

      • Informational

    • For Retention Period, enter the number of days you want to retain data.
    • For Event Format, select from the following options:
      • JSON
      • CEF
      • LEEF

  3. Click Save once you're done.

    Limits on Storage

    From the Illumio Core 19.3.1 release onwards, the PCE will automatically limit the maximum number of events stored. The limits are set on the volume of events stored locally in the PCE database, so that the events recorded in the database do not fill up the disk. The limit is a percentage of the disk capacity, cumulative for all services that store events on the disk.

    IMPORTANT:

    To change the default limits, contact Illumio Support.

    The configuration limit includes both hard and soft limits. For more details, see "PCE Default Object Limits" in the PCE Administration Guide.

    • Soft limit: 20% of disk used by event storage

      • Aggressive pruning is triggered when the soft limit is reached. However, new events are still recorded while pruning. On the Events list page of the PCE Web Console, the system_task.prune_old_log_events event is displayed with the "Object creation soft limit exceeded" message and 'Severity: Informational'.

    • Hard limit: 25% of disk used by event storage.

      • More aggressive pruning is triggered when the hard limit is reached. New events are not recorded while pruning. On the Events list page of the PCE Web Console, the system_task.prune_old_log_events event is displayed with the message "Object creation hard limit exceeded" message and 'Severity: Error'. The pruning continues until the soft limit level of 20% is reached. When this occurs, a system_task.hard_limit_recovery_completed event occurs, and the PCE starts to behave as it did for the soft limit conditions.