The InControl server management interface provides a number of options for management of the server. These are discussed in this chapter.

Displaying the Server Management Interface

Selecting Clavister InControl Server Settings from the Windows start menu causes the management user interface for the server to be displayed. Displaying this interface will not affect the running of the server if it is already started. If the server is not running then displaying the management interface will have the effect of also starting the server.

The InControl server runs as a Windows service and appears in the Windows process list as ICS.exe. It will be started automatically after initial installation and after hardware restart and will only be stopped by choosing the File > Service > Stop menu option in the server management interface (or alternatively, stopping it through the Windows process manager).

Stopping and Restarting the Server

Closing the server management interface will also not affect ICS.exe. If the service needs to be stopped or restarted then it is recommended that this is done with the Service > Stop or Restart option in the user interface.

Setting the Audit Level

The Audit Level determines which server audit messages are saved to disk as a log. These messages are generated by various server events such as shutdown and startup and are saved in a folder in the server installation directory for analysis through the InControl client. Only server messages that are at or above the set audit level priority will be logged and this level can be different from the general audit level described above.

It is important to remember that the server log messages being discussed here are totally separate from the log messages generated by cOS Core and relate only to server activity, not the activity of connected firewalls.

The server audit files can be viewed with a text editor but should not be edited in any way. Their format needs to be preserved, otherwise they cannot be viewed through the InControl client.

Configuring a Syslog Server

By setting the value of the Syslog parameter to True, server log messages can also be sent to an external Syslog server. The Syslog server's IP address needs to be specified, as well as the desired level of the messages that are sent.

The Server Interface Console

The server interface contains a Console tab which gives easy access to log messages generated by the server. By default, only server start-up and close-down messages appear in the console.

Applying and Saving Server Changes

After any changes are made in the server management interface, the Apply, Save and Revert changes options become enabled in the File menu as shown below:

These options function as follows:

The configuration file for the server is called ICS.exe.config in the server installation directory and this is where server parameter values are stored.

Once any unsaved change is made to the server configuration, this is indicated by an asterisk ("*") appearing to the right of the management interface window title as shown below.

Server Database Backups

The server provides a simple way to perform backups of the entire server database. It should be remembered that all configuration data for InControl is stored in this database so backup is strongly recommended.

Backing up does not require that InControl client activity stops. The server will, however, delay client responses until the backup process is complete. This means that client users may experience a slight delay after sending a request to the server during backup.

The following methods can be used for performing a backup:

The above options will now be discussed in detail.

1. Backup initiated through the server management interface

In the server management interface, select the menu option Database > Save.

By default, backups are stored in a single file of filetype .ics with a filename that shows the date and time when the backup was created. For example, db2015-02-26_153521.ics might be the default filename created by the interface, where the filename format is:

			dbyyyy-mm-dd_hhmmss.ics

The above file naming convention is, however, not mandatory and can be changed in the file chooser but is recommended as a useful way to keep track of when backup files were created. When a command line is used (as described below) this file naming convention is always used and cannot be changed.

When a backup or restore is performed via the server settings management interface, the InControl server will be automatically stopped and restarted

2. Backup initiated through the command line

It is possible to also create backup files through a Windows console command. The command takes the form:

> Server Settings.exe -backup <directory>

If the database backup is being saved to a directory called backup_1 then the command would be:

> Server Settings.exe -backup backup_1

The command should be issued when the current console directory is the InControl server installation directory. The backup filename used has the default naming format described above and cannot be changed before performing the backup.

When using the Server Settings command to perform a backup or restore, the InControl server will be automatically stopped and restarted.

3. Using a script to schedule automatic backups

A key advantage of backing up using a console command is the ability to use Windows to create a scheduled service that will automatically run a script file containing the command on a regular basis. Creating such a script as well as an example script template can be found in a Clavister knowledge base article at the following link:

https://kb.clavister.com/324735442

Restoring the Database

Restoration of a database backup can be done in a similar way to creating a backup, either through the Database > Load menu option or with the following Windows console command:

> Server Settings.exe -restore <path>

A restore will overwrite the existing database so that should be backed up if it may be required later.

When a database restore is complete, the InControl server will restart automatically and any connected clients will be automatically updated to reflect the configuration data in the new version of the database. Database updates or deployments initiated by clients during the restore process will be rejected by the server.

Moving the Server Between Computers

The backup and restore function also allows a server installation to be moved from one computer to another. Once the InControl server is installed on another computer, a database backup can then be restored to that new installation and the default empty database will be overwritten with the restored database backup.

Disk Space Management

The management interface provides settings for managing the disk space taken up by the server and its database.

These settings are used as follows:

The SQLite setting will be used for a future feature and should not be changed. This setting is totally separate from the database settings for the ILA server.

Installing a Custom Certificate for Client/Server Communication

For InControl versions after 3.03.01, certificate based gRPC is used for client/server communication. On first time startup of the InControl server, the server will install a self-signed certificate for this into the Windows certificate store.

If the administrator would like to use their own certificate, this can be done by installing it into the "Personal" certificate store for the user that runs the InControl server ("System account"). This must be followed by changing the certificate thumbprint in InControl server settings to match the thumbprint of the certificate to use. The detailed steps are as follows: