About VAST Uplink

VAST Uplink is a cloud-based SaaS that enables you to monitor all VAST clusters deployed by your organization anywhere in the world, from a single web page.      

The VAST Uplink cloud portal is enabled by request only, and is accessed through a unique subdomain for your organization. A VAST cluster reports to VAST Uplink only when such reporting is enabled in the VAST cluster's VMS.

Important

Starting with VAST Cluster 5.0, choosing a unique Uplink subdomain is required for the operation of the VAST Callhome service as well as for the Uplink cloud portal. Choosing an Uplink subdomain does not in itself enable the cloud portal, which you can choose to disable or enable independently of the Callhome service.

You can use VAST Uplink's cloud portal to:

VAST Uplink gives you a high-level view aggregated across all of your VAST Data clusters, providing the most useful real-time monitoring information at a glance, while also enabling you to access a more detailed view of the health, status, version levels, performance, and configuration of all clusters. You can view audit logs of various security-related processes in VAST Uplink. The portal also provides quick access to all alarms and tickets in parallel views.

Tip

To set up VAST Uplink usage for the first time, register an Uplink subdomain and then register each cluster that you want to monitor from Uplink.

Starting with Uplink 5.0, the VAST Callhome reporting service is provided through VAST Uplink. You can register for Uplink without enabling the cloud portal, in order to enable Callhome,  or you can register for Uplink with the cloud portal enabled. As before, the customer-facing Uplink cloud portal is entirely opt-in. If the cloud portal is disabled, the data is accessible to VAST Support only, as is the case with the legacy Callhome reporting system. The data sent is largely the same as that sent by the legacy Callhome reporting, with additions or changes noted below.

When reporting to VAST Uplink is enabled on a VAST cluster, the cluster collects and sends data to Uplink.

The following information is collected:

Note

Enabling obfuscation will remove all IPs, names, and other Customer identifiable data (CID) from all the above. CID within the reported data are replaced with generic identifiers (for example, 127.0.0.1 may be reported as `ip-1`). CID within REST API objects are encrypted using a unique encryption key (using libsodium) stored on the VMS. The encryption key does not leave the cluster.

Note

Enabling obfuscation may make it more difficult for support to identify and diagnose issues.

Note

The first three items in the list above are the same data that are already being sent by the legacy Callhome system. The last two are additional data used by the new Callhome infrastructure that improves VAST support, by allowing us to spot problems earlier using predictive analysis.

No data stored by customers on the cluster is ever sent to VAST.

All reporting APIs are encrypted with TLS 1.3 and require the cluster’s valid access token for all requests.

Note

The log bundles sent to VAST remain in /vast/bundles until the next reporting cycle, allowing you to inspect the contents.

Tip

In contrast with the legacy Callhome reporting, security is improved by making use of expiring cluster access tokens which must be refreshed hourly for all reporting. In addition, whereas the legacy Callhome reported all VMS objects and metrics hourly, the new reporting mechanism reports Object changesets and Cluster metrics as they are collected, resulting in greatly improved response times for VAST Support, reduced impact on cluster performance, and a reduction in the amount of data sent.

Important

All communication between Uplink and VAST Cluster is one-way. All communication is initiated by the cluster. At no time may VAST personnel access a cluster without access being granted explicitly by the customer.

All data is encrypted both in-flight (TLS 1.3) and at-rest (Using Google Cloud’s encryption-at-rest).

The data stores (Postgres, BigTable, BigQuery, Google Cloud Storage) are not directly accessible. Authenticated users access the data through  Uplink API servers which are connected to the data stores via a private network and provide read-only access. This includes VAST employees.

Note

If the Uplink Customer Portal is disabled, the reported data is only accessible to authenticated VAST Support users within VAST’s internal network.

Note

All session and access tokens expire after one hour and must be refreshed. For interactive user logins, the session token may be refreshed a maximum of 23 times before the user must re-authenticate. The refresh is done automatically unless the user logs out.

Tip

All access attempts (both successful and failed) and user actions are recorded in the Uplink’s audit log. This includes VAST Support.

Caution

After five unsuccessful login attempts an account becomes locked and must be unlocked by VAST Support.

When you register for Uplink you can choose whether to enable the Uplink cloud portal, or to register for Uplink's Callhome reporting service without enabling the cloud portal. If you do enable the Uplink cloud portal, your Uplink subdomain is created with an initial super user account owned by you.

This account can grant or revoke access for additional users or super users by creating and managing Uplink user or super user accounts.

These actions can be performed without the intervention of VAST Support, providing you with direct control of access to your Uplink subdomain.

Tip

All access attempts (both successful and failed) and user actions are recorded in the Uplink’s audit log.

Note

The VAST Support users assigned to your account will, of course, also have access to this data.