LOGAR: Fleet Log Aggregation & Centralized Provisioning System

Secure Log Aggregation, PKI Fleet Licensing & Centralized Delivery for Autonomous AI Analysis

LOGAR is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (mTLS) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, fleet auto-update package distribution, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to Hermes AI for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.

📚 WebUI Administrator Guide & Technical Wiki: Complete WebUI console guides, storage switching, ingestion queue tuning, fleet package distribution, zero-knowledge encryption, and REST API references are available on the LOGAR Gitea Wiki and the WebUI Administrator Guide.

---

Key Capabilities

• Zero-State Edge Forwarders: Windows (Win_Client) and Linux (Linux_Client) agents maintain zero local databases, zero cache files, and minimal memory footprint.
• Mutual TLS 1.3 (:9443): Enforces bidirectional cryptographic identity verification (ssl.CERT_REQUIRED) for all streaming log frames.
• Hierarchical PKI & Seat Licensing: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (logar.eibl.tech) over WebSockets. Active module capabilities (enterprise_db, auto_update) are introspected dynamically.
• Fleet Auto-Update & Binary Distribution: Centralized local binary distribution point with SHA-256 integrity verification, automated client version negotiation, and background pull orchestrator.
• Multi-Engine Storage Backend: Switch seamlessly between lightweight local SQLite (WAL mode) and external enterprise databases (PostgreSQL, MySQL, MariaDB) with automated schema migration.
• High-Throughput Ring Buffer: In-memory ingestion queue with configurable batch flushing to eliminate disk I/O bottlenecks during peak traffic bursts.
• Zero-Knowledge Data Encryption: End-to-end payload encryption at rest using server X.509 RSA-2048 / OpenPGP keys for external SQL databases.
• 12-Hour Temporal Persistence: Evaluates anomalies over a rolling 12-hour temporal window, tracking occurrence velocity and first/last seen metrics.
• Direct Hermes AI Provisioning (:8443): Exposes verified anomalous telemetry directly to Hermes AI via /api/hermes/report without heuristic bottlenecks.
• WebUI Dashboard: Authenticated, clean management console for live anomaly telemetry, client seat leasing, modular licensing status, storage engine configuration, and Sub-CA lifecycle management.

---

System Architecture

graph TB
    subgraph Authority [Master License Authority - logar.eibl.tech]
        M_CA[Master Root CA]
        AUTH_WS[WebSocket Licensing Hub]
    end

    subgraph ServerHub [LOGAR Server Hub]
        SUB_CA[Subordinate CA]
        SEAT_MGR[Dynamic Seat Manager]
        MTLS_SRV[mTLS 1.3 Ingestion Server<br/>Port 9443]
        TEMP_ENG[12h Temporal Persistence Engine]
        PROV_API[Hermes Provisioning & WebUI API<br/>Port 8443]
        
        SUB_CA --> SEAT_MGR
        SEAT_MGR --> MTLS_SRV
        MTLS_SRV --> TEMP_ENG
        TEMP_ENG --> PROV_API
    end

    subgraph EdgeNodes [Heterogeneous Edge Forwarders]
        WIN[Win_Client.exe<br/>Windows Event Logs]
        LIN[Linux_Client.bin<br/>systemd journalctl]
    end

    subgraph Downstream [Hermes AI Layer]
        HERMES[Hermes AI Engine]
    end

    M_CA -->|Signs Sub-CA Cert| SUB_CA
    AUTH_WS <==>|Live WebSocket Sync| SUB_CA
    
    WIN -->|1. Auto-Enrollment| SUB_CA
    LIN -->|1. Auto-Enrollment| SUB_CA
    WIN ==>|2. mTLS 1.3 Stream :9443| MTLS_SRV
    LIN ==>|2. mTLS 1.3 Stream :9443| MTLS_SRV
    PROV_API ==>|3. GET /api/hermes/report| HERMES

---

Quick Start & Automated Installers

LOGAR provides automated production service installers for both Linux (systemd) and Windows (services.msc via NSSM):

1. Server Hub Installation

• Linux (Automated systemd Installer):

  sudo ./compilation/install_linux_server.sh
  

  Deploys standalone Server.bin to /opt/logar-server, initializes PKI, and enables logar-server.service.

• Windows (Inno Setup / NSIS Installer): Download and execute LOGAR-Server-Setup.exe from Releases. Installs Server.exe into C:\Program Files\LOGAR-Server and registers LOGAR_Server Windows service.

Default WebUI Management Credentials

Once installed or executed, access the web console:

• URL: http://<server-ip>:8443/webui
• Default Username: admin
• Default Password: admin_logar_2026! (Configurable via LOGAR_ADMIN_USER / LOGAR_ADMIN_PASS or in the WebUI user settings)

2. Edge Forwarder Installation

• Linux Client (1-Line Non-Interactive Installer):

  sudo ./compilation/install_linux_client.sh "http://<HUB_HOST>:8443" "<ENROLLMENT_SECRET>"
  

  Auto-enrolls mTLS certificates to /etc/logar/certs (chmod 700), generates configuration, and activates logar-client.service.

• Windows Client (Inno Setup Installer):

  1. Download and run LOGAR-Client-Setup.exe (supports silent install /VERYSILENT).
  2. Place client_config.json (exported from Server WebUI) into C:\Program Files\LOGAR\client_config.json.
  3. The LOGAR_Client service starts and auto-enrolls immediately.

(Alternatively, standalone binaries ./Server.bin / ./Linux_Client.bin / .\Server.exe / .\Win_Client.exe can be executed directly without service installation).

---

Repository Structure

LOGAR/
├── assets/                            # Official vector SVGs, PNGs, ICOs, and branding bitmaps
│   ├── logo.svg                       # Master vector emblem
│   ├── logo_transparent.svg           # Transparent WebUI emblem
│   ├── logo_banner.svg                # Full brand banner
│   ├── logo.ico / favicon.ico         # Application & web icons
│   └── wizard_*.bmp                   # Installer dialog bitmaps
├── .gitea/workflows/                  # CI/CD pipelines (ci.yml, release.yml)
├── compilation/                       # Build scripts, Linux installers & Inno Setup scripts
│   ├── generate_branding_assets.py    # Asset & bitmap generator
│   ├── install_linux_client.sh        # Linux client systemd auto-installer
│   ├── install_linux_server.sh        # Linux server systemd auto-installer
│   ├── package_dist.py                # Standalone binary cross-compiler
│   └── upload_release.py              # Gitea release asset publisher
├── src/                               # Application source code
│   ├── Server.py                      # Central mTLS hub, temporal engine & REST API
│   ├── server_enrollment.py           # Sub-CA PKI and certificate generator
│   ├── Win_Client.py                  # Windows edge forwarder
│   └── Linux_Client.py                # Linux edge forwarder
├── tests/                             # Automated test suites (42 unit & integration tests)
├── LOGAR-LICENSING/                   # Standalone Master License Authority (Git submodule)
├── RELEASE_NOTES.md                   # Version history and security changelog
└── README.md                          # Repository overview

---

Ports & REST API Summary

Port	Protocol	Service	Description
9443	TCP / TLS 1.3	mTLS Log Ingestion	Mutual TLS socket listener for edge forwarders
8443	HTTP / REST	Management & Hermes API	WebUI, forwarder enrollment, seat management, and AI reports

Core Endpoints

• POST /api/client/enroll: Forwarder auto-enrollment and proactive certificate renewal.
• GET /api/clients: Returns active seat quota and registered edge forwarder telemetry (Admin Auth).
• GET /api/client/update/check: Evaluates client version and returns upgrade manifest with SHA-256 integrity digest.
• GET /api/client/update/download: Delivers OS-specific standalone binary packages for forwarder upgrades.
• GET /api/hermes/report: Structured JSON anomaly stream for Hermes AI reasoning.
• POST /api/license/sync: Triggers immediate WebSocket sync with logar.eibl.tech (Admin Auth).
• GET /health: Server health, encryption fingerprint, and mTLS status.

---

Enterprise Feature Capabilities

LOGAR uses cryptographic X.509 v3 custom extensions embedded inside activated .lic intermediate CA certificates issued by the Master Authority:

Feature Flag	Capability Name	Description	Default Status
enterprise_db	External DB & Ingestion Buffer	Unlocks PostgreSQL/MySQL storage backends, high-throughput in-memory RAM buffering with batch flushing, and OpenPGP zero-knowledge at-rest data encryption.	Enabled by default
auto_update	Fleet Auto-Update Orchestration	Enables central repository binary hosting, client version discovery, background update polling, and automated binary hot-upgrades.	Enabled by default

---

Fleet Auto-Update & Package Distribution

LOGAR operates a pull-based fleet package distribution architecture:

1. Central Server Repository: The Server Hub monitors upstream releases and hosts target client binaries (LOGAR_Client_Setup.exe, Linux_Client.bin) in the local repository (/opt/logar-server/updates/ or .\updates\).
2. Version Negotiation: Edge clients periodically contact GET /api/client/update/check?os=<windows|linux>&version=<current> to compare active versions against the Hub.
3. Integrity Verification: Client packages are validated using streaming SHA-256 digests prior to installation or hot-swap.
4. Client CLI Flags:
   • --auto-update: Enables automated background update polling and downloading.
   • --update-check-interval <seconds>: Configures update poll frequency (default: 3600s).
   • --check-update-now: Queries server for available updates and exits.

---

Testing & Cross-Compilation

# Run full unit test suite (51 tests)
python -m unittest discover -s tests -v

# Run end-to-end mTLS pipeline integration test
python tests/test_pipeline.py

# Cross-compile native Linux and Windows binaries on Linux runner
python compilation/package_dist.py --target all

---

Documentation & Deep Dives

For in-depth operational guides, lifecycle state machines, and PKI specifications, consult the LOGAR Gitea Wiki:

• WebUI Administrator Guide
• Architecture & Design Details
• System State Machines & Subsystem Lifecycles
• PKI Architecture & Custom X.509 Seat OIDs
• Complete REST API Specification
• Production Deployment & Service Management
• CI/CD Pipeline & Cross-Compilation Workflow
• Branding & Design System Guide