Configure the Sumo Logic LAM

The Sumo Logic LAM posts Sumo Logic alerts to Moogsoft Onprem as events.

You can install a basic Sumo Logic integration in the UI. See Sumo Logic for integration steps.

Configure the Sumo Logic LAM if you want to configure custom properties, set up high availability or configure advanced options that are not available in the UI integration.

Before You Begin

Before you configure the Sumo Logic LAM, ensure you have met the following requirements:

You have an active Sumo Logic account.
You have the necessary permissions to configure a webhook connection and metric monitor in Sumo Logic.
Sumo Logic can make requests to external endpoints over port 443.

If you are configuring a distributed deployment refer to High Availability Overview first. You will need the details of the server configuration you are going to use for HA.

Configure the LAM

Edit the configuration file to control the behavior of the Sumo Logic LAM. You can find the file at $MOOGSOFT_HOME/config/sumo_logic_lam.conf

See the Sumo Logic Reference and LAM and Integration Reference for a full description of all properties. Some properties in the file are commented out by default. Uncomment properties to enable them.

Configure the connection properties for Sumo Logic:
- address: Host name or IP address of Moogsoft Onprem.
- port: Port on which Moogsoft Onprem receives data from Sumo Logic.
Configure authentication:
- authentication_type: Type of authentication HTTP used by the LAM. Defaults to Basic.
- authentication_cache: Whether to cache the username and password for the current connection when the authentication type is Basic.
Configure the LAM behavior:
- num_threads: Number of worker threads to use when processing events.
- rest_response_mode: When to send a REST response. See the LAM and Integration Reference for the options.
- rpc_response_timeout: Number of seconds to wait for a REST response.
- event_ack_mode: When Moogfarmd acknowledges events from the Sumo Logic LAM during the event processing pipeline.
- accept_all_json: Allows the LAM to read and process all forms of JSON.
- lists_contain_multiple_events: Whether Moogsoft Onprem interprets a JSON list as multiple events.
Configure the SSL properties if you want to encrypt communications between the LAM and Sumo Logic:
- use_ssl: Whether to use SSL certification.
- path_to_ssl_files: Path to the directory that contains the SSL certificates.
- ssl_key_filename: The SSL server key file.
- ssl_cert_filename: The SSL root CA file.
- use_client_certificates: Whether to use SSL client certification.
- client_ca_filename: The SSL client CA file.
- auth_token or encrypted_auth_token: Authentication token in the request body.
- header_auth_token or encrypted_header_auth_token: Authentication token in the request header.
- ssl_protocols: Sets the allowed SSL protocols.
Optionally configure the LAM identification and capture logging details:
- name: Maps to $Laminstancename, so that the agent field indicates events Moogsoft Onprem ingests from this LAM.
- capture_log: Name and location of the LAM's capture log file, which it writes to for debugging purposes.
Review the severity conversion rules. Sumo Logic has only three severity levels and does not have an equivalent for the 'Clear' severity. The default severity mapping in the Sumo Logic LAM configuration file is:
```
"severity":
{
    "MissingData" : 2,
    "Warning": 3,
    "Critical": 5,
    moog_lookup_default: 1
}
```
You can modify these mappings if required. See Severity Reference for further information and "Conversion Rules" in Tokenize Source Event Data for details on conversions in general.
Optionally configure the process logging details:
- configuration_file: Name and location of the LAM's process log configuration file. See Configure Logging for more information.Configure Logging

Example

The following example demonstrates a Sumo Logic configuration.

monitor:
{
    name                                : "SumoLogic Lam",
    class                               : "CRestMonitor",
    port                                : 48019,
    address                             : "0.0.0.0",
    use_ssl                             : false,
    #path_to_ssl_files                  : "config",
    #ssl_key_filename                   : "server.key",
    #ssl_cert_filename                  : "server.pem",
    #use_client_certificates            : false,
    #client_ca_filename                 : "ca.crt",
    #auth_token                         : "my_secret",
    #encrypted_auth_token               : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",
    #header_auth_token                  : "my_secret",
    #encrypted_header_auth_token        : "dfJtTQMGiFHfiq7sCmxguBt6Jv+eytkoiKCquSB/7iWxpgGsG2aez3z2j7SuBtKj",
    #ssl_protocols                      : [ "TLSv1.2" ],
    authentication_type                 : "basic",
    authentication_cache                : true,
    accept_all_json                     : true,
    lists_contain_multiple_events       : false,
    num_threads                         : 5,
    rest_response_mode                  : "on_receipt",
    rpc_response_timeout                : 20,
    event_ack_mode                      : "queued_for_processing"
},
agent:
{
    name                                : "SumoLogic",
    capture_log                         : "$MOOGSOFT_HOME/log/data-capture/sumo_logic_lam.log"
},
log_config:
{
    configuration_file                  : "$MOOGSOFT_HOME/config/logging/sumo_logic_lam_log.json"
},

Configure for High Availability

Configure the Sumo Logic LAM for high availability if required. See High Availability Overview for details.

Configure LAMbot Processing

The Sumo Logic LAMbot processes and filters events before sending them to the Message Bus. You can customize or bypass this processing if required. You can also load JavaScript files into the LAMbot and execute them.

See LAMbot Configuration for more information. An example Sumo Logic LAM filter configuration is shown below.

filter:
{
    presend: "SumoLogicLam.js"
}

Start and Stop the LAM

Restart the Sumo Logic LAM to activate any changes you make to the configuration file or LAMbot.

The LAM service name is sumologiclamd.

See Control Moogsoft Onprem Processes for the commands to start, stop and restart the LAM.

You can use a GET request to check the status of the Sumo Logic LAM. See "Check the LAM Status" in Configure the REST LAM for further information and examples.

Configure Sumo Logic

After you have the Sumo Logic LAM running and listening for incoming requests, you can configure a webhook in Sumo Logic. See "Configure Sumo Logic" in Sumo Logic.

In this section: