LOGAR/out/win_client/README.md

LOGAR Windows Edge Forwarder

Standalone compiled executable distribution for Windows Server and workstation environments.

---

Overview

Win_Client.exe is a self-contained, pre-compiled executable that queries the Windows Application Event Log, filters candidate events at the source, encrypts the payload using OpenPGP, and streams records over an authenticated TCP socket to the central LOGAR hub.

Key Capabilities

• Pre-compiled & Dependency-Free: Ships as a standalone native Windows executable (Win_Client.exe). No Python installation, pip packages, or GnuPG binaries are required on the host.
• Source-Level Filtering: Retains events spanning INFO, WARNING, and ERROR. Strips audit success/failure events and debug noise, skipping events older than 24 hours.
• State Tracking & Deduplication: Maintains persistent client state in client_state.json (tracking event record numbers and timestamp signatures) so every log record is forwarded exactly once without duplicates.
• Fail-Safe State Commit: State is committed only when the server returns a verified success response. In the event of a network outage, state remains unchanged and unsent events are retried automatically on the next run.
• End-to-End Encryption: Encrypts payloads using the server's OpenPGP public key before transmission.

---

1. Generating & Deploying the Configuration File

Step 1: Generate client_config.json on the Server

Run the following command on your central LOGAR server to export a client bundle tailored for your environment:

python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json

• Replace <SERVER_IP_OR_DNS> with the reachable IP address or FQDN of your central LOGAR server hub.
• Default TCP port is 9443.

Step 2: Configuration Structure

The generated client_config.json contains:

{
  "server_host": "192.168.1.100",
  "server_port": 9443,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "auth_token": "a1b2c3d4e5f6..."
}

Note

A reference example is provided in client_config.sample.json. The configuration file contains no host-specific names or site names to ensure client anonymity and easy redistribution.

Step 3: Copy to Edge Node

Place Win_Client.exe and client_config.json in the target directory (recommended: C:\LOGAR\):

New-Item -ItemType Directory -Path "C:\LOGAR" -Force
Copy-Item "Win_Client.exe", "client_config.json" -Destination "C:\LOGAR\"

---

2. Running Manually

Test the forwarder interactively from PowerShell or Command Prompt:

cd C:\LOGAR
.\Win_Client.exe --hours 24

Command-Line Arguments

Argument	Default	Description
--config	client_config.json	Path to client configuration file
--hours	24	Lookback window in hours for event logs
--state-file	client_state.json	Path to persistent state tracking file
--no-state	False	Disable state tracking and send all events matching lookback window

---

3. Installing as a Background Service / Scheduled Task

Edge forwarders run as episodic background processes (run, forward unsent candidate records, commit state, and terminate). On Windows, this is natively managed via Windows Task Scheduler running as a background service under SYSTEM.

Method A: Windows Scheduled Task via PowerShell (Recommended)

Open an Elevated PowerShell (Run as Administrator) window and execute:

# Define action and periodic trigger (every 3 hours indefinitely)
$Action = New-ScheduledTaskAction -Execute "C:\LOGAR\Win_Client.exe" -Argument "--hours 24" -WorkingDirectory "C:\LOGAR"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 3)

# Configure task settings (wake on sleep, start when ready, run hidden)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 15)

# Register task running under the local SYSTEM account with highest privileges
Register-ScheduledTask -TaskName "LOGAR_Forwarder" `
                       -Action $Action `
                       -Trigger $Trigger `
                       -Settings $Settings `
                       -User "NT AUTHORITY\SYSTEM" `
                       -RunLevel Highest `
                       -Description "LOGAR Windows Edge Log Forwarder Service"

# Verify task creation and trigger immediate execution
Start-ScheduledTask -TaskName "LOGAR_Forwarder"
Get-ScheduledTask -TaskName "LOGAR_Forwarder"

Method B: Continuous Windows Service via NSSM

If your organizational policy requires a formal Windows Service listed under services.msc:

1. Download NSSM (Non-Sucking Service Manager).
2. Install the service using NSSM:

   nssm.exe install LOGAR_Forwarder "C:\LOGAR\Win_Client.exe" "--hours 24"
   nssm.exe set LOGAR_Forwarder AppDirectory "C:\LOGAR"
   nssm.exe set LOGAR_Forwarder AppRestartDelay 10800000
   nssm.exe start LOGAR_Forwarder
   

   (Note: AppRestartDelay 10800000 pauses 3 hours between execution cycles).

---

4. Uninstallation & Removal

To remove the scheduled task:

Unregister-ScheduledTask -TaskName "LOGAR_Forwarder" -Confirm:$false
Remove-Item -Recurse -Force "C:\LOGAR"