Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 me0nline
|
cfc633c398 | ||
|
me0nline
|
d61e343fbe | ||
|
me0nline
|
4a446a2e73 | ||
|
me0nline
|
b24108a788 |
+45
-58
@@ -1,40 +1,56 @@
|
||||
# LOGAR Linux Edge Forwarder
|
||||
|
||||
Standalone compiled binary distribution for Linux edge servers running systemd.
|
||||
Standalone compiled binary and automated systemd service distribution for Linux edge servers.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
`Linux_Client.bin` is a self-contained, pre-compiled executable that queries `systemd-journald` via `journalctl`, filters logs directly at the source, encrypts the payload using OpenPGP, and streams candidate events over an authenticated TCP socket to the central LOGAR hub.
|
||||
`Linux_Client.bin` is a self-contained, pre-compiled executable that queries `systemd-journald` via `journalctl`, filters logs directly at the source, auto-enrolls with the central LOGAR hub, and streams candidate events over mutual TLS 1.3 (**mTLS**) to the central hub.
|
||||
|
||||
### Key Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone executable binary (`Linux_Client.bin`). No Python environment, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR` (`journalctl -p info`). Drops debug noise (priority 7) and skips events older than 24 hours.
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native binary (`Linux_Client.bin`). No Python environment, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion**: Streams directly over hardware-authenticated TLS 1.3 sockets with machine-bound client certificates.
|
||||
- **Automated Client Enrollment**: On first run with an `enrollment_secret`, the client automatically calls `POST /api/client/enroll` on the hub, saves its certificates into `/etc/logar/certs/`, and establishes secure mTLS streaming.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR` (`journalctl -p warning`). Drops debug noise and skips events older than 24 hours.
|
||||
- **State Tracking & Deduplication**: Maintains persistent client state in `client_state.json` (tracking systemd journalctl cursors and microsecond timestamps) so every log record is forwarded exactly once without duplicates.
|
||||
- **Fail-Safe State Commit**: State is committed only when the server returns a verified `success` response. In the event of a network outage, state remains unchanged and unsent events are retried automatically on the next run.
|
||||
- **End-to-End Encryption**: Encrypts payloads using the server's OpenPGP public key before transmission.
|
||||
|
||||
---
|
||||
|
||||
## 1. Generating & Deploying the Configuration File
|
||||
## 1. Automated Installation via Script (Recommended)
|
||||
|
||||
Run the automated installer script:
|
||||
```bash
|
||||
sudo ./compilation/install_linux_client.sh "http://<HUB_HOST>:8443" "<ENROLLMENT_SECRET>"
|
||||
```
|
||||
This script:
|
||||
1. Installs the binary to `/opt/logar-client/Linux_Client`.
|
||||
2. Creates `/etc/logar/certs` with strict permissions.
|
||||
3. Automatically queries `/etc/machine-id` and enrolls with the hub via `curl`.
|
||||
4. Deploys, enables, and starts the systemd service unit `/etc/systemd/system/logar-client.service`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating & Deploying the Configuration File
|
||||
|
||||
### Step 1: Generate `client_config.json` on the Server
|
||||
Run the following command on your central LOGAR server to export a client bundle tailored for your environment:
|
||||
|
||||
Run the following command on your central LOGAR server:
|
||||
```bash
|
||||
python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
|
||||
- Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.
|
||||
- Default TCP port is `9443`.
|
||||
- Default mTLS socket port is `9443`; Hermes REST API port is `8443`.
|
||||
|
||||
### Step 2: Configuration Structure
|
||||
The generated `client_config.json` contains:
|
||||
|
||||
```json
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"hermes_host": "192.168.1.100",
|
||||
"hermes_port": 8443,
|
||||
"enrollment_secret": "a1b2c3d4e5f6...",
|
||||
"cert_dir": "certs",
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"auth_token": "a1b2c3d4e5f6..."
|
||||
@@ -42,11 +58,10 @@ The generated `client_config.json` contains:
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> A reference example is provided in `client_config.sample.json`. The configuration file contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
> The configuration contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
|
||||
### Step 3: Copy to Edge Node
|
||||
Place `Linux_Client.bin` and `client_config.json` into the target directory (recommended: `/opt/logar/`):
|
||||
|
||||
Place `Linux_Client.bin` and `client_config.json` into the target directory (e.g. `/opt/logar/`):
|
||||
```bash
|
||||
sudo mkdir -p /opt/logar
|
||||
sudo cp Linux_Client.bin client_config.json /opt/logar/
|
||||
@@ -55,14 +70,14 @@ sudo chmod +x /opt/logar/Linux_Client.bin
|
||||
|
||||
---
|
||||
|
||||
## 2. Running Manually
|
||||
## 3. Running Manually
|
||||
|
||||
Test the forwarder interactively:
|
||||
|
||||
```bash
|
||||
cd /opt/logar
|
||||
./Linux_Client.bin --hours 24
|
||||
```
|
||||
On first run, the client contacts `http://<hermes_host>:<hermes_port>/api/client/enroll`, downloads `ca.crt`, `client.crt`, and `client.key` into `certs/`, and streams logs over mTLS.
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Default | Description |
|
||||
@@ -74,13 +89,10 @@ cd /opt/logar
|
||||
|
||||
---
|
||||
|
||||
## 3. Installing as a Systemd Service & Timer (Recommended)
|
||||
|
||||
Running `Linux_Client.bin` via a systemd timer ensures reliable periodic execution, automatic restart, and native log integration with `journalctl`.
|
||||
## 4. Manual Systemd Service & Timer Setup
|
||||
|
||||
### Step 1: Create the Systemd Service Unit
|
||||
Create `/etc/systemd/system/logar-forwarder.service`:
|
||||
|
||||
Create `/etc/systemd/system/logar-client.service`:
|
||||
```ini
|
||||
[Unit]
|
||||
Description=LOGAR Edge Log Forwarder
|
||||
@@ -88,9 +100,11 @@ After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/logar
|
||||
ExecStart=/opt/logar/Linux_Client.bin --hours 24
|
||||
Restart=always
|
||||
RestartSec=5s
|
||||
User=root
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
@@ -99,51 +113,24 @@ StandardError=journal
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
### Step 2: Create the Systemd Timer Unit
|
||||
Create `/etc/systemd/system/logar-forwarder.timer` to execute the forwarder every 3 hours (with a 5-minute initial delay upon boot):
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=Run LOGAR Edge Forwarder periodically
|
||||
Requires=logar-forwarder.service
|
||||
|
||||
[Timer]
|
||||
OnBootSec=5min
|
||||
OnUnitActiveSec=3h
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
```
|
||||
|
||||
### Step 3: Enable and Start the Timer
|
||||
### Step 2: Enable and Start the Service
|
||||
```bash
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now logar-forwarder.timer
|
||||
sudo systemctl enable --now logar-client.service
|
||||
```
|
||||
|
||||
### Step 4: Verify Timer & Service Status
|
||||
### Step 3: Check Logs
|
||||
```bash
|
||||
# Check timer schedule
|
||||
sudo systemctl list-timers --all | grep logar
|
||||
|
||||
# Trigger an immediate manual execution
|
||||
sudo systemctl start logar-forwarder.service
|
||||
|
||||
# View execution logs
|
||||
sudo journalctl -u logar-forwarder.service -n 50
|
||||
sudo journalctl -u logar-client.service -n 50 -f
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. Alternative: Cron Job Deployment
|
||||
|
||||
If systemd timers are not preferred, configure a periodic cron job running every 3 hours:
|
||||
## 5. Uninstallation & Removal
|
||||
|
||||
```bash
|
||||
# Open root crontab
|
||||
sudo crontab -e
|
||||
|
||||
# Add the following entry:
|
||||
0 */3 * * * cd /opt/logar && ./Linux_Client.bin --hours 24 >> /var/log/logar_forwarder.log 2>&1
|
||||
sudo systemctl disable --now logar-client.service
|
||||
sudo rm -f /etc/systemd/system/logar-client.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo rm -rf /opt/logar-client /opt/logar /etc/logar
|
||||
```
|
||||
|
||||
+60
-146
@@ -1,31 +1,45 @@
|
||||
# LOGAR Linux Server Hub
|
||||
|
||||
Standalone compiled executable binary distribution for Linux server environments (`Server.bin`).
|
||||
Standalone compiled binary and automated systemd service distribution for Linux server environments (`Server.bin`).
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
`Server.bin` is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination and log analysis hub of the LOGAR telemetry architecture.
|
||||
`Server.bin` is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination, log analysis, dynamic PKI, and reporting hub of the LOGAR telemetry architecture.
|
||||
|
||||
### Key Architecture & Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
|
||||
- **Authenticated TCP Ingestion Socket (Port 9443)**: Accepts framed OpenPGP encrypted log batches streamed by edge forwarders (`Linux_Client.bin` and `Win_Client.exe`).
|
||||
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events are evaluated against an episodic threshold, requiring persistence across at least 4 distinct client transmission cycles within a sliding 12-hour evaluation window before promotion from transient noise to `VERIFIED`.
|
||||
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report` for external scrapers, SIEM collectors, and alerting dashboards.
|
||||
- **Pure-Python OpenPGP Cryptography**: Zero dependency on external `gpg` binaries. Automatically generates RSA-2048 encryption keys and SHA-256 fingerprints on first launch.
|
||||
- **State Database**: Tracks anomaly lifecycles, run counters, and machine telemetry in a local SQLite state database (`logar_state.db`).
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite.
|
||||
- **Dynamic PKI & License Accounting**: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via `POST /api/client/enroll` while enforcing seat limits (`max_seats`).
|
||||
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events require persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window.
|
||||
- **Embedded Hermes Reporting & Management API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
||||
|
||||
---
|
||||
|
||||
## 1. Initializing & Generating Server Configuration
|
||||
## 1. Automated Installation via Script (Recommended)
|
||||
|
||||
Deploy using the automated installer:
|
||||
```bash
|
||||
sudo ./compilation/install_linux_server.sh
|
||||
```
|
||||
This script:
|
||||
1. Installs the server binary to `/opt/logar-server/Server`.
|
||||
2. Creates `/etc/logar` and `/var/log/logar`.
|
||||
3. Deploys, enables, and starts the systemd service unit `/etc/systemd/system/logar-server.service` with `LimitNOFILE=65536`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Initializing & Generating Server Configuration
|
||||
|
||||
### Step 1: Automatic First-Run Generation
|
||||
When launched without an existing `server_config.json`, `Server.bin` automatically generates:
|
||||
1. A fresh OpenPGP RSA-2048 encryption keypair (`private_key` and `public_key`).
|
||||
2. A SHA-256 public encryption fingerprint (`server_fingerprint`).
|
||||
3. A cryptographically random secret authentication token (`auth_token`).
|
||||
4. Default network socket coordinates (TCP 9443, Hermes API 8443).
|
||||
1. An internal Root CA (`certs/ca.crt` and `certs/ca.key`).
|
||||
2. A server TLS certificate (`certs/server.crt` and `certs/server.key`) with SANs.
|
||||
3. An OpenPGP RSA-2048 keypair (`private_key` and `public_key`).
|
||||
4. Cryptographically random authentication tokens and enrollment secrets.
|
||||
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).
|
||||
|
||||
Run `Server.bin` once to initialize:
|
||||
```bash
|
||||
@@ -37,11 +51,20 @@ Output:
|
||||
[+] Successfully generated new server config and OpenPGP keypair.
|
||||
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
[+] Saved to: server_config.json
|
||||
============================================================
|
||||
LOGAR Server Hub: LOGAR-Cloud-Hub
|
||||
Transport Security: mTLS (TLS 1.3)
|
||||
License Quota: 10 Active Seats
|
||||
Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
|
||||
============================================================
|
||||
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
|
||||
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
|
||||
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll
|
||||
```
|
||||
|
||||
### Step 2: Configuration Fields Reference
|
||||
The generated `server_config.json` contains:
|
||||
|
||||
```json
|
||||
{
|
||||
"server_name": "LOGAR-Linux-Hub",
|
||||
@@ -50,6 +73,10 @@ The generated `server_config.json` contains:
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
|
||||
"enrollment_secret": "e1f2a3b4c5d6...",
|
||||
"max_seats": 10,
|
||||
"cert_dir": "certs",
|
||||
"tls_enabled": true,
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 4,
|
||||
@@ -59,150 +86,37 @@ The generated `server_config.json` contains:
|
||||
}
|
||||
```
|
||||
|
||||
| Parameter | Default | Description |
|
||||
| :--- | :--- | :--- |
|
||||
| `server_name` | `"LOGAR-Linux-Hub"` | Human-readable identifier for this hub instance |
|
||||
| `tcp_host` | `"0.0.0.0"` | Network interface to bind for edge client TCP ingestion |
|
||||
| `tcp_port` | `9443` | TCP port for incoming edge log batches |
|
||||
| `hermes_host` | `"0.0.0.0"` | Network interface to bind for Hermes HTTP API |
|
||||
| `hermes_port` | `8443` | HTTP port for the Hermes reporting endpoint |
|
||||
| `auth_token` | *(auto-generated)* | Pre-shared secret required in edge client envelopes |
|
||||
| `db_path` | `"logar_state.db"` | Path to persistent SQLite issue database |
|
||||
| `evaluation_window_hours` | `12` | Sliding temporal window for warning persistence |
|
||||
| `min_persistence_runs` | `4` | Number of distinct runs required to promote warnings to `VERIFIED` |
|
||||
---
|
||||
|
||||
## 3. Exporting Client Configurations
|
||||
|
||||
Generate a client configuration bundle to deploy onto Windows or Linux forwarders:
|
||||
```bash
|
||||
./Server.bin --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating Client Configuration Bundles
|
||||
## 4. Manual Systemd Service Management
|
||||
|
||||
Edge forwarders (`Linux_Client.bin` and `Win_Client.exe`) require a minimal, anonymous configuration bundle containing socket coordinates, the authentication token, and the server's public key (without sensitive server names or private keys).
|
||||
|
||||
Run the following command on the server:
|
||||
Check service status:
|
||||
```bash
|
||||
./Server.bin --create-client-config --server-host <SERVER_PUBLIC_OR_INTERNAL_IP> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
|
||||
- Replace `<SERVER_PUBLIC_OR_INTERNAL_IP>` with the reachable IP or FQDN of your LOGAR server.
|
||||
- The output `client_config.json` can be distributed directly to Linux and Windows edge forwarder nodes.
|
||||
|
||||
---
|
||||
|
||||
## 3. Running Interactively
|
||||
|
||||
```bash
|
||||
./Server.bin --config /path/to/server_config.json
|
||||
```
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Description |
|
||||
| :--- | :--- |
|
||||
| `--config` | Path to server configuration JSON file (default: `server_config.json`) |
|
||||
| `--create-client-config` | Exports an anonymous client configuration bundle and exits |
|
||||
| `--server-host` | Hostname/IP to embed in the exported client configuration |
|
||||
| `--server-port` | Port to embed in the exported client configuration (default: `9443`) |
|
||||
| `--client-out` | Destination path for exported client configuration (default: `client_config.json`) |
|
||||
|
||||
---
|
||||
|
||||
## 4. Installing as a Systemd Service (Recommended)
|
||||
|
||||
Running `Server.bin` as a native systemd background service ensures continuous execution, automatic restart upon reboot or crash, and centralized log management via `journalctl`.
|
||||
|
||||
### Step 1: Create Deployment Directory and User
|
||||
```bash
|
||||
# Create dedicated system group and user
|
||||
sudo useradd --system --no-create-home --shell /usr/sbin/nologin logar
|
||||
|
||||
# Prepare deployment folder
|
||||
sudo mkdir -p /opt/logar-server
|
||||
sudo cp Server.bin server_config.json /opt/logar-server/
|
||||
sudo chmod +x /opt/logar-server/Server.bin
|
||||
sudo chown -R logar:logar /opt/logar-server
|
||||
```
|
||||
|
||||
### Step 2: Create Systemd Service File
|
||||
Create `/etc/systemd/system/logar-server.service`:
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=LOGAR Central Server Hub Service
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=logar
|
||||
Group=logar
|
||||
WorkingDirectory=/opt/logar-server
|
||||
ExecStart=/opt/logar-server/Server.bin --config /opt/logar-server/server_config.json
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
LimitNOFILE=65536
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
### Step 3: Enable and Start Service
|
||||
```bash
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now logar-server.service
|
||||
```
|
||||
|
||||
### Step 4: Verify Status and Inspect Logs
|
||||
```bash
|
||||
# Check service status
|
||||
sudo systemctl status logar-server.service
|
||||
```
|
||||
|
||||
# Stream live server logs
|
||||
sudo journalctl -u logar-server.service -f
|
||||
Inspect live service logs:
|
||||
```bash
|
||||
sudo journalctl -u logar-server.service -f -n 50
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Hermes Reporting API & Integration
|
||||
|
||||
The server embeds a high-performance HTTP service on port `8443` providing real-time intelligence on promoted anomalies:
|
||||
|
||||
### Fetching Promoted Anomalies
|
||||
```bash
|
||||
curl -s http://127.0.0.1:8443/api/hermes/report | jq .
|
||||
```
|
||||
|
||||
### Response Schema:
|
||||
```json
|
||||
[
|
||||
{
|
||||
"fingerprint": "prod-web-01.corp.internal:Out_Of_Memory",
|
||||
"server": "prod-web-01.corp.internal",
|
||||
"signature": "Out_Of_Memory",
|
||||
"consecutive_runs": 4,
|
||||
"first_seen": "2026-09-04T08:00:00Z",
|
||||
"last_seen": "2026-09-04T14:30:00Z",
|
||||
"status": "VERIFIED",
|
||||
"verified": true,
|
||||
"os_type": "linux",
|
||||
"sample_message": "kernel: Out of memory: Kill process 1824"
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Firewall Configuration
|
||||
|
||||
Ensure the following inbound ports are open on your host firewall:
|
||||
## 5. Uninstallation & Removal
|
||||
|
||||
```bash
|
||||
# UFW (Ubuntu / Debian)
|
||||
sudo ufw allow 9443/tcp comment "LOGAR TCP Log Ingestion"
|
||||
sudo ufw allow 8443/tcp comment "LOGAR Hermes Reporting API"
|
||||
sudo ufw reload
|
||||
|
||||
# Firewalld (RHEL / CentOS / Rocky / Alma)
|
||||
sudo firewall-cmd --permanent --add-port=9443/tcp
|
||||
sudo firewall-cmd --permanent --add-port=8443/tcp
|
||||
sudo firewall-cmd --reload
|
||||
sudo systemctl disable --now logar-server.service
|
||||
sudo rm -f /etc/systemd/system/logar-server.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo rm -rf /opt/logar-server /etc/logar /var/log/logar
|
||||
```
|
||||
|
||||
+48
-44
@@ -1,40 +1,56 @@
|
||||
# LOGAR Windows Edge Forwarder
|
||||
|
||||
Standalone compiled executable distribution for Windows Server and workstation environments.
|
||||
Standalone compiled executable and installer distribution for Windows Server and workstation environments.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
`Win_Client.exe` is a self-contained, pre-compiled executable that queries the Windows Application Event Log, filters candidate events at the source, encrypts the payload using OpenPGP, and streams records over an authenticated TCP socket to the central LOGAR hub.
|
||||
`Win_Client.exe` is a self-contained executable that queries the Windows Application Event Log, filters candidate events at the source, auto-enrolls with the central LOGAR hub to receive signed mTLS certificates, and streams records over mutual TLS 1.3 (**mTLS**) socket connection.
|
||||
|
||||
### Key Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Windows executable (`Win_Client.exe`). No Python installation, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR`. Strips audit success/failure events and debug noise, skipping events older than 24 hours.
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Windows executable (`Win_Client.exe`) or full installer (`LOGAR-Client-Setup.exe`). No Python installation, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion**: Streams directly over hardware-authenticated TLS 1.3 sockets with hardware/machine-bound client certificates.
|
||||
- **Automated Client Enrollment**: On first run with an `enrollment_secret`, the client automatically calls `POST /api/client/enroll` on the hub, saves its certificates into `certs/`, and establishes secure mTLS streaming.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR`. Strips audit events and debug noise, skipping events older than 24 hours.
|
||||
- **State Tracking & Deduplication**: Maintains persistent client state in `client_state.json` (tracking event record numbers and timestamp signatures) so every log record is forwarded exactly once without duplicates.
|
||||
- **Fail-Safe State Commit**: State is committed only when the server returns a verified `success` response. In the event of a network outage, state remains unchanged and unsent events are retried automatically on the next run.
|
||||
- **End-to-End Encryption**: Encrypts payloads using the server's OpenPGP public key before transmission.
|
||||
|
||||
---
|
||||
|
||||
## 1. Generating & Deploying the Configuration File
|
||||
## 1. Automated Installation via Inno Setup (Recommended)
|
||||
|
||||
Run the self-contained installer built from `compilation/installer_client.iss`:
|
||||
```powershell
|
||||
.\LOGAR-Client-Setup.exe
|
||||
```
|
||||
This installer:
|
||||
1. Installs `Win_Client.exe` and bundled `nssm.exe` to `C:\Program Files\LOGAR\`.
|
||||
2. Sets up directory permissions in `C:\ProgramData\LOGAR\`.
|
||||
3. Registers and starts the `LOGAR_Client` Windows service automatically via NSSM.
|
||||
4. Redirects stdout and stderr logs to `C:\ProgramData\LOGAR\client.log` and `client_err.log`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating & Deploying the Configuration File
|
||||
|
||||
### Step 1: Generate `client_config.json` on the Server
|
||||
Run the following command on your central LOGAR server to export a client bundle tailored for your environment:
|
||||
|
||||
Run the following command on your central LOGAR server:
|
||||
```bash
|
||||
python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
|
||||
- Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.
|
||||
- Default TCP port is `9443`.
|
||||
- Default mTLS socket port is `9443`; Hermes REST API port is `8443`.
|
||||
|
||||
### Step 2: Configuration Structure
|
||||
The generated `client_config.json` contains:
|
||||
|
||||
```json
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"hermes_host": "192.168.1.100",
|
||||
"hermes_port": 8443,
|
||||
"enrollment_secret": "a1b2c3d4e5f6...",
|
||||
"cert_dir": "certs",
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"auth_token": "a1b2c3d4e5f6..."
|
||||
@@ -42,11 +58,10 @@ The generated `client_config.json` contains:
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> A reference example is provided in `client_config.sample.json`. The configuration file contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
> The configuration contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
|
||||
### Step 3: Copy to Edge Node
|
||||
Place `Win_Client.exe` and `client_config.json` in the target directory (recommended: `C:\LOGAR\`):
|
||||
|
||||
Place `client_config.json` next to `Win_Client.exe` (e.g. `C:\Program Files\LOGAR\` or `C:\LOGAR\`):
|
||||
```powershell
|
||||
New-Item -ItemType Directory -Path "C:\LOGAR" -Force
|
||||
Copy-Item "Win_Client.exe", "client_config.json" -Destination "C:\LOGAR\"
|
||||
@@ -54,14 +69,14 @@ Copy-Item "Win_Client.exe", "client_config.json" -Destination "C:\LOGAR\"
|
||||
|
||||
---
|
||||
|
||||
## 2. Running Manually
|
||||
## 3. Running Manually
|
||||
|
||||
Test the forwarder interactively from PowerShell or Command Prompt:
|
||||
|
||||
```powershell
|
||||
cd C:\LOGAR
|
||||
.\Win_Client.exe --hours 24
|
||||
```
|
||||
On first run, the client contacts `http://<hermes_host>:<hermes_port>/api/client/enroll`, downloads `ca.crt`, `client.crt`, and `client.key` into `certs/`, and streams logs over mTLS.
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Default | Description |
|
||||
@@ -73,22 +88,24 @@ cd C:\LOGAR
|
||||
|
||||
---
|
||||
|
||||
## 3. Installing as a Background Service / Scheduled Task
|
||||
|
||||
Edge forwarders run as episodic background processes (run, forward unsent candidate records, commit state, and terminate). On Windows, this is natively managed via Windows Task Scheduler running as a background service under `SYSTEM`.
|
||||
|
||||
### Method A: Windows Scheduled Task via PowerShell (Recommended)
|
||||
Open an **Elevated PowerShell (Run as Administrator)** window and execute:
|
||||
## 4. Manual Service Installation (NSSM or Scheduled Task)
|
||||
|
||||
### Method A: Windows Service via Bundled NSSM
|
||||
```powershell
|
||||
# From the compilation directory or with bundled nssm.exe:
|
||||
.\nssm.exe install LOGAR_Client "C:\LOGAR\Win_Client.exe" "--hours 24"
|
||||
.\nssm.exe set LOGAR_Client AppDirectory "C:\LOGAR"
|
||||
.\nssm.exe set LOGAR_Client AppStdout "C:\ProgramData\LOGAR\client.log"
|
||||
.\nssm.exe set LOGAR_Client AppStderr "C:\ProgramData\LOGAR\client_err.log"
|
||||
.\nssm.exe start LOGAR_Client
|
||||
```
|
||||
|
||||
### Method B: Windows Scheduled Task via PowerShell
|
||||
```powershell
|
||||
# Define action and periodic trigger (every 3 hours indefinitely)
|
||||
$Action = New-ScheduledTaskAction -Execute "C:\LOGAR\Win_Client.exe" -Argument "--hours 24" -WorkingDirectory "C:\LOGAR"
|
||||
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 3)
|
||||
|
||||
# Configure task settings (wake on sleep, start when ready, run hidden)
|
||||
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 15)
|
||||
|
||||
# Register task running under the local SYSTEM account with highest privileges
|
||||
Register-ScheduledTask -TaskName "LOGAR_Forwarder" `
|
||||
-Action $Action `
|
||||
-Trigger $Trigger `
|
||||
@@ -97,31 +114,18 @@ Register-ScheduledTask -TaskName "LOGAR_Forwarder" `
|
||||
-RunLevel Highest `
|
||||
-Description "LOGAR Windows Edge Log Forwarder Service"
|
||||
|
||||
# Verify task creation and trigger immediate execution
|
||||
Start-ScheduledTask -TaskName "LOGAR_Forwarder"
|
||||
Get-ScheduledTask -TaskName "LOGAR_Forwarder"
|
||||
```
|
||||
|
||||
### Method B: Continuous Windows Service via NSSM
|
||||
If your organizational policy requires a formal Windows Service listed under `services.msc`:
|
||||
|
||||
1. Download [NSSM (Non-Sucking Service Manager)](https://nssm.cc/).
|
||||
2. Install the service using NSSM:
|
||||
```cmd
|
||||
nssm.exe install LOGAR_Forwarder "C:\LOGAR\Win_Client.exe" "--hours 24"
|
||||
nssm.exe set LOGAR_Forwarder AppDirectory "C:\LOGAR"
|
||||
nssm.exe set LOGAR_Forwarder AppRestartDelay 10800000
|
||||
nssm.exe start LOGAR_Forwarder
|
||||
```
|
||||
*(Note: `AppRestartDelay 10800000` pauses 3 hours between execution cycles).*
|
||||
|
||||
---
|
||||
|
||||
## 4. Uninstallation & Removal
|
||||
## 5. Uninstallation
|
||||
|
||||
To remove the scheduled task:
|
||||
If installed via the Inno Setup installer, use **Windows Add/Remove Programs** or run `unins000.exe` in `C:\Program Files\LOGAR\`.
|
||||
|
||||
If installed manually via NSSM:
|
||||
```powershell
|
||||
Unregister-ScheduledTask -TaskName "LOGAR_Forwarder" -Confirm:$false
|
||||
.\nssm.exe stop LOGAR_Client
|
||||
.\nssm.exe remove LOGAR_Client confirm
|
||||
Remove-Item -Recurse -Force "C:\LOGAR"
|
||||
```
|
||||
|
||||
+61
-177
@@ -1,31 +1,45 @@
|
||||
# LOGAR Windows Server Hub
|
||||
|
||||
Standalone compiled executable distribution for Windows Server environments (`Server.exe`).
|
||||
Standalone compiled executable and installer distribution for Windows Server environments (`Server.exe`).
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
`Server.exe` is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, and reporting hub of the LOGAR infrastructure.
|
||||
`Server.exe` is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, dynamic PKI certificate authority, and reporting hub of the LOGAR infrastructure.
|
||||
|
||||
### Key Architecture & Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone Windows executable (`Server.exe`). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
|
||||
- **Authenticated TCP Ingestion Socket (Port 9443)**: Ingests framed OpenPGP encrypted log batches streamed from edge forwarder nodes (`Win_Client.exe` and `Linux_Client.bin`).
|
||||
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events are evaluated against an episodic threshold, requiring persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window before promotion to `VERIFIED`.
|
||||
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report` for external dashboards, monitoring agents, and scrapers.
|
||||
- **Pure-Python OpenPGP Cryptography**: Automatically generates RSA-2048 encryption keys and a SHA-256 fingerprint on first launch without external dependencies.
|
||||
- **State Database**: Stores issue lifecycle records, run counters, and machine telemetry in a local SQLite database (`logar_state.db`).
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone Windows executable (`Server.exe`) or full installer (`LOGAR-Server-Setup.exe`). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite.
|
||||
- **Dynamic PKI & License Accounting**: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via `POST /api/client/enroll` while enforcing seat limits (`max_seats`).
|
||||
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events require persistence across at least 4 distinct transmission cycles within a rolling 12-hour evaluation window.
|
||||
- **Embedded Hermes Reporting & Management API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
||||
|
||||
---
|
||||
|
||||
## 1. Initializing & Generating Server Configuration
|
||||
## 1. Automated Installation via Inno Setup (Recommended)
|
||||
|
||||
Run the self-contained installer built from `compilation/installer_server.iss`:
|
||||
```powershell
|
||||
.\LOGAR-Server-Setup.exe
|
||||
```
|
||||
This installer:
|
||||
1. Installs `Server.exe` and bundled `nssm.exe` to `C:\Program Files\LOGAR-Server\`.
|
||||
2. Registers and starts the `LOGAR_Server` Windows service automatically via NSSM.
|
||||
3. Redirects stdout and stderr logs to `C:\ProgramData\LOGAR-Server\server.log` and `server_err.log`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Initializing & Generating Server Configuration
|
||||
|
||||
### Step 1: Automatic First-Run Generation
|
||||
When launched without an existing `server_config.json`, `Server.exe` automatically initializes:
|
||||
1. An OpenPGP RSA-2048 encryption keypair (`private_key` and `public_key`).
|
||||
2. A SHA-256 public encryption fingerprint (`server_fingerprint`).
|
||||
3. A cryptographically random secret authentication token (`auth_token`).
|
||||
4. Default network socket coordinates (TCP 9443, Hermes API 8443).
|
||||
1. An internal Root CA (`certs/ca.crt` and `certs/ca.key`).
|
||||
2. A server TLS certificate (`certs/server.crt` and `certs/server.key`) with SANs.
|
||||
3. An OpenPGP RSA-2048 keypair (`private_key` and `public_key`).
|
||||
4. Cryptographically random authentication tokens and enrollment secrets.
|
||||
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).
|
||||
|
||||
Open PowerShell and run:
|
||||
```powershell
|
||||
@@ -37,11 +51,20 @@ Output:
|
||||
[+] Successfully generated new server config and OpenPGP keypair.
|
||||
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
[+] Saved to: server_config.json
|
||||
============================================================
|
||||
LOGAR Server Hub: LOGAR-Cloud-Hub
|
||||
Transport Security: mTLS (TLS 1.3)
|
||||
License Quota: 10 Active Seats
|
||||
Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
|
||||
============================================================
|
||||
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
|
||||
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
|
||||
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll
|
||||
```
|
||||
|
||||
### Step 2: Configuration Fields Reference
|
||||
The generated `server_config.json` contains:
|
||||
|
||||
```json
|
||||
{
|
||||
"server_name": "LOGAR-Windows-Hub",
|
||||
@@ -50,6 +73,10 @@ The generated `server_config.json` contains:
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
|
||||
"enrollment_secret": "e1f2a3b4c5d6...",
|
||||
"max_seats": 10,
|
||||
"cert_dir": "certs",
|
||||
"tls_enabled": true,
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 4,
|
||||
@@ -59,179 +86,36 @@ The generated `server_config.json` contains:
|
||||
}
|
||||
```
|
||||
|
||||
| Parameter | Default | Description |
|
||||
| :--- | :--- | :--- |
|
||||
| `server_name` | `"LOGAR-Windows-Hub"` | Identifier for this hub instance |
|
||||
| `tcp_host` | `"0.0.0.0"` | Network interface to bind for incoming client socket traffic |
|
||||
| `tcp_port` | `9443` | TCP port for incoming edge log batches |
|
||||
| `hermes_host` | `"0.0.0.0"` | Network interface to bind for Hermes HTTP API |
|
||||
| `hermes_port` | `8443` | HTTP port for the Hermes reporting endpoint |
|
||||
| `auth_token` | *(auto-generated)* | Pre-shared authentication secret required in client envelopes |
|
||||
| `db_path` | `"logar_state.db"` | Path to persistent SQLite issue database |
|
||||
| `evaluation_window_hours` | `12` | Rolling evaluation window in hours for warning persistence |
|
||||
| `min_persistence_runs` | `4` | Consecutive runs required to promote warning issues to `VERIFIED` |
|
||||
---
|
||||
|
||||
## 3. Exporting Client Configurations
|
||||
|
||||
Generate a client configuration bundle to deploy onto Windows or Linux forwarders:
|
||||
```powershell
|
||||
.\Server.exe --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating Client Configuration Bundles
|
||||
|
||||
Edge forwarders (`Win_Client.exe` and `Linux_Client.bin`) require an anonymous client configuration bundle that includes the server socket target, authentication token, and encryption public key, without exposing sensitive server names or private keys.
|
||||
|
||||
Run the following command on the server:
|
||||
```powershell
|
||||
.\Server.exe --create-client-config --server-host <SERVER_IP_OR_FQDN> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
|
||||
- Replace `<SERVER_IP_OR_FQDN>` with the reachable IP or DNS name of your LOGAR server.
|
||||
- Distribute `client_config.json` to client forwarder nodes along with `Win_Client.exe` or `Linux_Client.bin`.
|
||||
|
||||
---
|
||||
|
||||
## 3. Running Interactively
|
||||
## 4. Manual Windows Service Setup (via NSSM)
|
||||
|
||||
```powershell
|
||||
.\Server.exe --config C:\LOGAR-Server\server_config.json
|
||||
```
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Description |
|
||||
| :--- | :--- |
|
||||
| `--config` | Path to server configuration JSON file (default: `server_config.json`) |
|
||||
| `--create-client-config` | Exports an anonymous client configuration bundle and exits |
|
||||
| `--server-host` | Hostname/IP to embed in the exported client configuration |
|
||||
| `--server-port` | Port to embed in the exported client configuration (default: `9443`) |
|
||||
| `--client-out` | Destination path for exported client configuration (default: `client_config.json`) |
|
||||
|
||||
---
|
||||
|
||||
## 4. Installing as a Continuous Windows Service
|
||||
|
||||
Because `Server.exe` acts as a continuous server hub (listening for TCP connections and HTTP API queries), it should run persistently in the background.
|
||||
|
||||
### Method A: Native Windows Service via NSSM (Recommended)
|
||||
[NSSM (Non-Sucking Service Manager)](https://nssm.cc/) is the industry standard for wrapping standalone executables into formal Windows services managed by `services.msc`.
|
||||
|
||||
1. Place `Server.exe` and `server_config.json` in `C:\LOGAR-Server\`.
|
||||
2. Open **Elevated PowerShell (Run as Administrator)**:
|
||||
```powershell
|
||||
# Create deployment folder
|
||||
New-Item -ItemType Directory -Path "C:\LOGAR-Server" -Force
|
||||
Copy-Item "Server.exe", "server_config.json" -Destination "C:\LOGAR-Server\"
|
||||
|
||||
# Install Windows Service via NSSM
|
||||
nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe" "--config C:\LOGAR-Server\server_config.json"
|
||||
nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
|
||||
nssm.exe set LOGAR_Server Description "LOGAR Central Aggregation Hub Service"
|
||||
nssm.exe set LOGAR_Server Start SERVICE_AUTO_START
|
||||
nssm.exe set LOGAR_Server AppStdout "C:\LOGAR-Server\server_out.log"
|
||||
nssm.exe set LOGAR_Server AppStderr "C:\LOGAR-Server\server_err.log"
|
||||
|
||||
# Start the service
|
||||
nssm.exe start LOGAR_Server
|
||||
```
|
||||
3. Verify status in PowerShell:
|
||||
```powershell
|
||||
Get-Service -Name "LOGAR_Server"
|
||||
```
|
||||
|
||||
### Method B: Windows Task Scheduler (Startup Daemon)
|
||||
If third-party service wrappers are restricted by organizational policy, configure a Task Scheduler job triggered at boot under the `SYSTEM` account:
|
||||
|
||||
```powershell
|
||||
# Action: Launch Server.exe
|
||||
$Action = New-ScheduledTaskAction -Execute "C:\LOGAR-Server\Server.exe" `
|
||||
-Argument "--config C:\LOGAR-Server\server_config.json" `
|
||||
-WorkingDirectory "C:\LOGAR-Server"
|
||||
|
||||
# Trigger: At system startup
|
||||
$Trigger = New-ScheduledTaskTrigger -AtStartup
|
||||
|
||||
# Settings: Restart on failure, no execution time limit
|
||||
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries `
|
||||
-DontStopIfGoingOnBatteries `
|
||||
-StartWhenAvailable `
|
||||
-RestartCount 3 `
|
||||
-RestartInterval (New-TimeSpan -Minutes 1) `
|
||||
-ExecutionTimeLimit ([TimeSpan]::Zero)
|
||||
|
||||
# Register task under SYSTEM with highest privileges
|
||||
Register-ScheduledTask -TaskName "LOGAR_Server_Daemon" `
|
||||
-Action $Action `
|
||||
-Trigger $Trigger `
|
||||
-Settings $Settings `
|
||||
-User "NT AUTHORITY\SYSTEM" `
|
||||
-RunLevel Highest `
|
||||
-Description "LOGAR Central Hub Daemon"
|
||||
|
||||
# Start the task immediately
|
||||
Start-ScheduledTask -TaskName "LOGAR_Server_Daemon"
|
||||
Get-ScheduledTask -TaskName "LOGAR_Server_Daemon"
|
||||
.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
|
||||
.\nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
|
||||
.\nssm.exe set LOGAR_Server AppStdout "C:\ProgramData\LOGAR-Server\server.log"
|
||||
.\nssm.exe set LOGAR_Server AppStderr "C:\ProgramData\LOGAR-Server\server_err.log"
|
||||
.\nssm.exe start LOGAR_Server
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Hermes Reporting API & Health Checks
|
||||
## 5. Uninstallation
|
||||
|
||||
Test the embedded Hermes REST endpoint locally using PowerShell:
|
||||
If installed via the Inno Setup installer, use **Windows Add/Remove Programs**.
|
||||
|
||||
If installed manually via NSSM:
|
||||
```powershell
|
||||
$report = Invoke-RestMethod -Uri "http://127.0.0.1:8443/api/hermes/report" -Method GET
|
||||
$report | Format-Table fingerprint, status, consecutive_runs, first_seen, last_seen
|
||||
```
|
||||
|
||||
### Response Format:
|
||||
```json
|
||||
[
|
||||
{
|
||||
"fingerprint": "win-dc-01.corp.internal:DiskCorruptionDetected",
|
||||
"server": "win-dc-01.corp.internal",
|
||||
"signature": "DiskCorruptionDetected",
|
||||
"consecutive_runs": 4,
|
||||
"first_seen": "2026-09-04T08:15:00Z",
|
||||
"last_seen": "2026-09-04T15:00:00Z",
|
||||
"status": "VERIFIED",
|
||||
"verified": true,
|
||||
"os_type": "windows",
|
||||
"sample_message": "An error was detected on device \\Device\\Harddisk0\\DR0 during a paging operation."
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Windows Defender Firewall Configuration
|
||||
|
||||
Open the necessary inbound firewall ports to allow incoming edge forwarder socket streams and HTTP API queries:
|
||||
|
||||
```powershell
|
||||
# Allow TCP 9443 for edge log forwarding
|
||||
New-NetFirewallRule -DisplayName "LOGAR TCP Log Ingestion" `
|
||||
-Direction Inbound `
|
||||
-LocalPort 9443 `
|
||||
-Protocol TCP `
|
||||
-Action Allow
|
||||
|
||||
# Allow TCP 8443 for Hermes Reporting REST API
|
||||
New-NetFirewallRule -DisplayName "LOGAR Hermes Reporting API" `
|
||||
-Direction Inbound `
|
||||
-LocalPort 8443 `
|
||||
-Protocol TCP `
|
||||
-Action Allow
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Uninstallation & Removal
|
||||
|
||||
To remove the server service:
|
||||
```powershell
|
||||
# If installed via NSSM:
|
||||
nssm.exe stop LOGAR_Server
|
||||
nssm.exe remove LOGAR_Server confirm
|
||||
|
||||
# If installed via Task Scheduler:
|
||||
Unregister-ScheduledTask -TaskName "LOGAR_Server_Daemon" -Confirm:$false
|
||||
|
||||
# Clean files
|
||||
Remove-Item -Recurse -Force "C:\LOGAR-Server"
|
||||
.\nssm.exe stop LOGAR_Server
|
||||
.\nssm.exe remove LOGAR_Server confirm
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user