System tab

The Configuration: System tab contains system-wide configuration options. It includes the following options:

PF_RING Enabled

If Enabled, use the PF_RING driver to speed up packet capture.

Note:

The use of PF_RING in Sensor appliances has been deprecated with the update to Ubuntu Xenial Xerus. This control is only used for legacy systems. On recent NICs and virtual sensors, this toggle enables AF_PACKET.

This option is only available for the Sensor.

AF_PACKET Enabled

If Enabled, use the AF_PACKET driver for packet capture. AF_PACKET is a high performance acquisition strategy. It replaces PF_RING, offering better support for recent NICs and virtual sensors.

If the Sensor detects a supported NIC, it enables the AF_PACKET driver. It is generally safe to enable AF_PACKET on any NIC and vNIC, as the technology is likely to deliver better performance.

This option is only available for the Sensor.

Auto Update

If Enabled, the appliance automatically updates when new software versions are released by VMware.

Syslog streaming

If Enabled, you can stream the system logs from the server hosting the appliance to a remote syslog server. It streams all files from the /var/log directory (such as auth.log, kernel.log, etc.). It can be used for enhanced security; for example, by setting a policy of using sudo to run privileged commands combined with syslog streaming, the history of all privileged commands run on the system will be logged to the remote log server.

When Enabled, you must define at least one destination server in the displayed Syslog Destinations list. For each destination, select the Protocol (UDP or TCP) and enter a Host (IP address or FQDN) and Port (default is port 514).

Use the Actions to delete the entry (click ) or reset the port (click ).