How to license and install Syslog Analytics

This article covers how to license and install Syslog Analytics 

How to obtain license and download the OVA

1. Login to https://www.MySonicWall.com account
2. Select your firewall unit under Product Management|My Products and click on the Licenses icon
   
   
3. Click on either Buy (purchase the license), Try(30 day trial license), or Activate (apply license key if obtained from prior purchase)

                  
   
   Once we license the Syslog Analytics by entering Key and/or Enabling Trial, it will provide us option to create New Tenant or Existing Tenant. Selecting New Tenant will create Syslog Analytics serial which we need to use while registering the Syslog Analytics. Select Existing Tenant if Syslogs Analytics serial is already been created and this is second firewall which we need to associate with Syslog Analytics. 
   

   
   
   

   NOTE: If this option is not availalable we can navigate to Product Details | TO-DO List to complete Syslog Analytics Association.

    
   
   
4. Firewall is now licensed for Syslog Analytics and we can register Syslog Analytics using new Serial or existing serial generated in above step.                                                                             

   
   
   

5. Download the OVA file under Resources & Support|Download Center, select On-premises Analytics in search options,click download on latest for ESXi

   

Installing with VMware ESXi

1. Login to VMware and click Create/Register VM
   
   
   
2. Select Deploy a virtual machine from an OVF or OVA file and click Next
   

   
   
   

3. Enter server name, select the OVA file and click Next
   

   
   
   

4. Select the storage type/datastore which to store the files for the Syslog Analytics and click Next
   

   
   
   

5. Click I agree for the license agreements after reading and then click Next
   

   
   
   

6. In the Network mapping select the networks in your inventory to be used for the Syslog Analytics, Thin or Thick provisioned format, and Uncheck the power on automatically (that way you can edit the server specs prior to booting)
   
   

   
   
   

7. Enter optional SonicCore Hostname and click Next
   

   
   
   

8. Verify selected options and click Finish to start the OVA deployment
   

   
   
   

9. Monitor the progress till it is complete

   
   
   

10. After completed, right click on the new VM and select Edit settings
    

    
    
    

11. Increase CPU/Memory/Hard Disk accordingly based on your licensing and Firewall types/quantity of units (recommend minimum 16GB Memory , 4CPUs(2.4 GHz processor), and 500GB of storage) and click Save
    

    
    
    

12. Click Power on to boot the server, it may take 5-10 minutes before completed

    
    
    

Configuring Host Settings on the Console

After powering on the Syslog Analytics Appliance, perform the following steps to open the console and configure the IP address and default route settings.

1. Select the VM and click on Console option
   
   

   
   
   

2. Using the Up/Down Left/Right arrows on the keyboard, select Network Interfaces and press enter on the keyboard to modify a any of the network settings. Make sure to save when finished

   
   
   

Logging into the Syslog Analytics and deployment using Wizard Guide

1. Enter the server IP in URL to access the Web GUI to login to the Syslog Analytics system interface. The default credentials are admin/password

   
   
   

2. The System Configuration Wizard will pop-up, click Next and confirm the Network Settings/Time Settings are correct
   

   
   
   

3. Click Apply and the system will prompt to reboot, click okay and wait for reboot to finish
   

    

   

   
   

4. After Restart is finished, login to Syslog Analytics System Interface
   

   
   
   

5. After logging in, the Analytics install Wizard will pop-up. Click Next and select Syslog based for the reporting type , then click Next

   

      

            

6.     

   
   

   
   

   
   

   Click Apply and then wait till it finishes applying the new settings, then click finish and the system will reboot 

     
   

    

    

     

   
   

   
   

   
   

   
   

      

   
   

   
   

Registering the Syslog Analytics and changing the default admin credentials

1. Login to the Syslog Analytics System Interface
   

   
   
   

2. Navigate to System|Licenses and enter the MySonicWall username/email that the Syslog Analytics is registered and enter the credentials of that account. Then click Login

    
   
   

3. Now enter the Syslog Analytics Serial Number/Authentication Code(can get it from MySonicWall account under Product Management|My Products|select product details ), and Friendly Name (can be anything). Click Submit
   

   
   
   

4. You will now see the License info, you may need to click Refresh to sync the correct info

    
   
   

5. Navigate to System|Administration to change the System Interface admin credentials. Enter current password, new password and click Update

    

Adding SonicWall Appliances to the Syslog Analytics

1. Login on the Application Interface ( /sgms ) using default admin/password credentials
   

    
   
   

2. Click on the '+' icon in the upper left corner of the tree control panel and you will get the Add Firewall pop-up. Enter the Firewall Name (can be anything), the Serial Number, and the Model. Then click OK
   
     

    

   
   

   
   

   
   
   
   

3. Now login to the Firewall and navigate to Manage|Log Settings|SYSLOG and click ADD. On the pop-up create a new address object for the Syslog Analytics server and then click OK     

    

   
   

4. Can now see the Syslog server is added to the Firewall and should begin to have Syslogs sent to the Analytics server 

   

5. Navigate to Manage|Log Settings|Base Setup and click Import Template. Select the Analyzer/Viewpoint/GMS Template option and click Accept (this will make sure logging levels are set correctly for the firewall to send data to the Analytics)
     

    

6. Return now back to the Syslog Analytics to confirm the unit added shows status as 'Up" and confirm that there is reporting data