Fastvue
Try for free
Reporter for Sophos Firewall

Installation guide

Fastvue Reporter can be up and running in as little as five minutes following this simple installation guide.

WindowsLinux

Minimum Server Requirements

Download Fastvue Reporter and install on a machine (or virtual machine) that meets our recommended requirements below.

What are the supported Windows Operating Systems?

Fastvue Reporter is designed for 64 bit Windows Server Operating Systems running Windows Server 2012 R2, or above.

Fastvue does not support Windows Desktop operating systems such as Windows 10 or 11 due to conflicts with other applications and ports.

What are the RAM and CPU requirements?

The CPU and RAM requirements vary based on the amount of log file data you’re importing, the number of reports being generated, and the alerts you’ve configured.

Here are some rough guidelines based on the number of people in your network:

Network SizeRecommended Server Specification
Up to 100 Users4 CPUs/Cores, 8 GB RAM
100 – 500 Users4 CPUs/Cores, 12 GB RAM
500 – 2000 Users 4 CPUs/Cores, 16 GB RAM
2000 – 3000 Users8 CPUs/Cores, 32 GB RAM
3000+ Users16 CPUs/Cores, 64 GB RAM

This is a rough guide only, and we recommend installing on a Virtual Machine so you can scale these resources up or down as required.

What are the data storage requirements?

Recommended disk space

Every organization is different, and it only takes a particularly chatty application to drastically change the log data generated between two similarly sized networks.

Fastvue Reporter's default data retention policy is 90 days, or 90% of the available drive space at the time of installation, whichever comes first.

When setting up a new server, as a very rough rule of thumb, allocate enough disk space to store 15 MB per user per day, and use an environment where this disk can be easily adjusted in the future.

Install the free 14-day trial and let the software run for a few days. Then head to Settings > Data Storage. Here you will see how much data has been imported per day, along with a Daily Average figure.

Go to Settings > Data Storage > Settings and try increasing the number of days from the default 90, to the number of days you want to store. You'll notice the estimate underneath the edit box changes to show you the amount of hard drive space you need to allow for based on the Daily Average seen so far.

Likewise, you can change the Size policy to see the number of days the set amount of hard drive space will accommodate.

Use SSDs if possible

Fastvue Reporter uses Elasticsearch as its database. This is I/O intensive and has considerable performance benefits when running on SSD disks. Fastvue recommends SSD disks to avoid performance-related issues, especially when monitoring medium to large networks.

We don't advise installing to a network drive due to latency issues affecting the stability of our very frequent read-write operations.

Don't install to a mapped network drive, or use a mapped network drive as Fastvue Reporter’s data path, as the assigned drive letters won't exist in the system context – only the user context. If you must use a network drive, specify a UNC path such as \servername-or-ip\fastvue. But keep in mind the performance issues mentioned above, and you'll have to configure ‘full’ permissions for the Fastvue Server’s local system account.

Installation

Note: In order to import data and run reports as fast as possible, Fastvue Reporter can be resource intensive. We do not recommend installing Fastvue Reporter on a server that provides a critical services such as a Domain Controller, DNS server, or DFS server. We recommend installing on a dedicated VM (virtual machine) so you can scale the resources appropriately.

To install Fastvue Reporter:

  1. Double-click the downloaded setup exe on a machine that meets the above requirements.
  2. The installer automatically installs and configures the required pre-requisites which include .Net 4.6 and IIS (Web Server and Application Server roles). It will also install Open JDK and Elasticsearch in its own self-managed directory.
  3. Once the pre-requisites have been installed, proceed through the installation wizard. It will ask you for:
    • Installation folder
      Only application files are installed to this folder and it does not require much disk space. The default is C:\Program Files\Fastvue\{Product Name}.
    • Website and Virtual Directory
      This is the website and sub-folder (virtual directory) within IIS to install the Fastvue Reporter website into. The default is Default Web Site.

      If you have other websites installed on your server, it is a good idea to either create a new website in IIS first and install to that, or use the 'sub-directory' option and enter a name such as ‘fastvue’ or ‘reports’. This creates a contained 'virtual directory' in IIS under the main website which you can access using http://yourserver/fastvue (for example).
    • Data Location
      This is the location where all imported data, configuration and report files are stored. Specify a location with plenty of disk space. The default is C:\ProgramData\Fastvue\{Product Name}.
  4. Navigate to the Fastvue Reporter web interface in your web browser. If you are on the server you installed, this will be http://localhost or http://localhost/sub-folder-name if you specified a sub-folder in step 3 above (replace sub-folder-name with the actual name you specified). You can also replace localhost with the server's name or IP address to access the web interface from a different machine.

Upgrading

To upgrade an earlier version of Fastvue Reporter, simply run the new installer over the top of your existing installation. The installer will pick up your existing settings, so just click next throughout the wizard without making any changes. Once installed, browse to the site and clear the browser cache by hitting ctrl + F5 (cmd + R on Mac).

Note that it can take a few minutes for data to start importing again after upgrades and restarts of the Fastvue Reporter service. You can check the database initialisation progress in Settings | Diagnostic | Database.

Automated / Silent Deployment

If you need to deploy or upgrade Fastvue Reporter silently or to multiple servers in an automated way, please see our comprehensive Reporter 4.0 PowerShell script.

Configure Syslog on your Sophos Firewall

Configure your Sophos firewall(s) to send syslog data to the Fastvue Reporter server on an available port. The default port commonly used for syslog is 514.

Sophos Firewall Syslog Configuration (previously XGS / XG)

On your Sophos Firewall, ensure you have a firewall rule with a ‘Web Policy’ applied and the ‘Log Traffic’ checkbox checked.

Then go to Configure | System Services | Log and add the Fastvue server as a syslog server with these settings:

  • Name = Fastvue Reporter (or anything that makes sense to you)
  • IP address / Domain = Your Fastvue Reporter server's IP or FQDN
  • Secure log transmission = Leave unchecked
  • Port = Any unused port on Fastvue machine (514 is the common default)
  • Facility = Daemon
  • Severity = Information
  • Format = Standard syslog protocol

Then scroll down and check the checkbox for the Fastvue Reporter server next to the following log events and click Apply:

  • Firewall | Firewall rules
  • Firewall | SSL VPN tunnel
  • IPS | Anomaly
  • IPS | Signatures
  • Antivirus | Check all events
  • Content filtering | Check all events
  • Events | Check all events
  • Advanced threat response | ATP events
  • Zero-day protection | Zero-day protection events
Sophos SG / UTM Syslog Configuration

Ensure Sophos SG has the Web Filtering feature enabled and applied to your network, with at least one category set to block or warn. Check the Web Filtering live log to ensure traffic is being logged.

Go to Web Admin | Logging and Reporting | Log Settings | Remote Syslog, and add the Fastvue server as a syslog server with these settings:

  • Server = Fastvue Reporter Server IP (add a new host object if necessary)
  • Port = Drag in the predefined SYSLOG protocol. If you have another application installed on the Fastvue machine listening on port 514, then use a custom port such as 50514.

Check the Web Filtering checkbox in the Remote Syslog Log Selection section and click Apply.


Add a Source

Add your firewall as a Source in Fastvue Reporter. This can be done on the start page that is presented after installation, or by going to Settings | Sources and clicking Add Source.

If your firewall is sending syslog data on port 514, click into the dropdown and wait a few seconds. The dropdown will populate with the name and/or IP of the device(s) sending syslog traffic to the Fastvue Server. Simply select your firewall from the list and click Add Source.

If your firewall is sending syslog data on a different port (such as 50514 if using the Linux / Docker version), Fastvue Reporter will not automatically display your firewall in the dropdown list. In this case, manually enter your firewall's IP and your selected syslog port into the options provided, then click Add Source.

Note: If entering your firewall and port manually, make sure the IP is the one your Fastvue Server is receiving syslog data from. This could be the IP of the internal LAN interface on your firewall, or if you have intermediate devices routing syslog traffic, it could be the interface IP of the last hop.

If you're unsure, you can a 'dummy' source with an invalid name (such as 'dummy') but specify the custom syslog port your firewall is sending syslog data on. Fastvue Reporter will then start listening on the port specified. You can then click Add Source again, and the dropdown list should populate with any device sending syslog data on your custom syslog port.

It may take 10-20 seconds before the first records are imported. You can watch the records and dates imported in Settings | Sources. Once records start importing, you can go to the Dashboard tab to see your network traffic.

Enjoy

Now you can try out the many features of Fastvue Reporter!