me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity
Files
ca1b5b5d255140c5eff8fdd0efee57aad0dd5ca3
LOGAR/wiki/Admin-Guide.md
T
me0nline ca1b5b5d25
CI Test Suite / Run Component Tests & Pipeline Verification (push) Successful in 1m19s
Details
docs: streamline admin guide to focus on WebUI management
2026-09-30 18:08:59 +02:00

11 KiB
Raw Blame History

WebUI Administrator Guide

Welcome to the LOGAR WebUI Administrator Guide. This guide provides step-by-step instructions for managing and operating the LOGAR Server Hub through its graphical web console (:8443/webui).

For deep architectural design, cryptographic protocols, X.509 OID schemas, and full REST API specifications, please refer to the dedicated technical wiki pages:

Table of Contents

  1. Accessing the Web Console & Authentication
  2. Dashboard: Live Verified Telemetry
  3. Fleet Seat Management & Client Provisioning
  4. Sub-CA & Modular Licensing
  5. Storage Engine & Ingestion Performance
  6. Hermes AI Tokens & Integration
  7. User Account & 2FA Security

1. Accessing the Web Console & Authentication

The LOGAR Server Hub provides an authenticated web management portal accessible from any modern web browser.

URL & Port

  • Management Console URL: http://<SERVER_IP>:8443/webui
  • Protocol: HTTP (or HTTPS behind an enterprise reverse proxy / load balancer)

Default Credentials

Upon first launch, LOGAR initializes default administrative credentials:

  • Username: admin
  • Password: admin_logar_2026!

Security Recommendation: Change the default credentials immediately after initial deployment using the User Settings menu.

2. Dashboard: Live Verified Telemetry

Tab: 📊 Live Telemetry

The Live Telemetry view displays real-time anomalous log events aggregated across all enrolled Windows and Linux edge forwarders.

Key Controls & Information

  • Severity Filter: Filter events by ALL, CRITICAL, ERROR, or WARNING.
  • Temporal Tracking: View occurrence frequency (Runs: N), first seen timestamp, and relative last seen time (e.g. 2m ago).
  • Source Attribution: Inspect originating Hostname, Machine GUID, and Operating System badge (Windows / Linux).
  • Message Payload: Inspect the raw extracted log message and normalized signature.
  • Auto-Refresh: Live stream updates automatically; displays the latest 50 active anomaly frames.

3. Fleet Seat Management & Client Provisioning

Tab: 💻 Client Seats

Manage connected edge forwarders (Win_Client and Linux_Client), enforce cryptographic seat quotas, and export client configuration profiles.

Seat Quota Overview

  • Displays the current seat consumption ratio (e.g., 3 / 25 Seats in Use).
  • Unlicensed servers allow local log collection (0 / 0 Seats) while blocking remote mTLS forwarders until a license is imported.

Managing Enrolled Forwarders

The client seat table lists every registered forwarder with its Machine Identifier, Hostname, OS Type, IP Address, First Enrolled date, and Status:

  • 🟢 Active: The forwarder has valid mTLS certificates and is actively streaming logs.
  • 🔴 Revoked: The forwarder's mTLS certificate has been administratively revoked. Ingestion from this client is rejected.
  • Action Buttons:
    • Revoke: Temporarily revoke a client's seat and deny incoming connections.
    • Reactivate / Approve: Re-enable a previously revoked client seat.
    • Delete: Remove the client record and release the seat back to the available pool.

Exporting Client Configuration

Click 📥 Download Client Config to generate and download client_config.json.

  • Contains the server's connection endpoints (server_host:9443), Sub-CA public certificate, encryption fingerprint, and enrollment secret.
  • Distribute this file to edge forwarders during deployment for instant zero-touch auto-enrollment.

4. Sub-CA & Modular Licensing

Tab: 📜 Sub-CA & Licensing

Manage the server's Subordinate Certificate Authority (Sub-CA), verify hardware host binding, view active licensed capabilities, and apply license updates.

Sub-CA Status & Fingerprints

  • CA Subject: The Distinguished Name (DN) of the local Sub-CA.
  • Server Encryption Fingerprint: SHA-256 / OpenPGP fingerprint for encrypted payloads.
  • Validity Period: Issue date and certificate expiration date.
  • Assigned Seat Quota: Maximum authorized forwarder capacity.

✨ Licensed Capabilities & Feature Modules

This section displays all authorized feature modules:

  • enterprise_db: Multi-engine external database support (PostgreSQL / MySQL / MariaDB), high-throughput ring buffering, and zero-knowledge data encryption at rest.
  • Standard Edition: If running without an enterprise license, standard local SQLite storage remains active.

License Management Operations

  • Export License Request (.lic): Click 📤 Export CSR (.lic) to download the server's hardware-bound certificate signing request. Send this file to your organization's Master License Authority administrator.
  • Import Signed Sub-CA Certificate: Paste the signed PEM certificate received from the Master Authority into the text area and click 📥 Import Signed Certificate. The server reloads its SSLContext and updates seat quotas in-flight with zero downtime.
  • Live WebSocket Sync: Click 🔄 Sync with License Hub to trigger immediate real-time synchronization with logar.eibl.tech.

5. Storage Engine & Ingestion Performance

Tab: 🗄️ Database Engine

Configure ingestion buffering, payload encryption at rest, and database backends.

┌─────────────────────────────────────────────────────────────┐
│ 1. INGESTION RING BUFFER & BATCH FLUSHER (Top)              │
│    • Mode: Direct (Sync) / In-Memory Ring Buffer            │
│    • Batch Flush Interval (sec) & Batch Size (events)       │
├─────────────────────────────────────────────────────────────┤
│ 2. PAYLOAD ENCRYPTION AT REST (Middle)                      │
│    • Toggle: OpenPGP / RSA-2048 Payload Encryption          │
├─────────────────────────────────────────────────────────────┤
│ 3. STORAGE BACKEND SELECTION (Bottom)                       │
│    • Local SQLite (WAL Mode)                                │
│    • External SQL Server (PostgreSQL / MySQL / MariaDB)     │
└─────────────────────────────────────────────────────────────┘

1. Ingestion Ring Buffer (Top Section)

Tune log ingestion throughput to prevent socket I/O bottlenecks during high-volume spikes:

  • Cache Mode:
    • Direct (Synchronous): Commits incoming log batches immediately to disk. Recommended for small deployments (< 20 nodes).
    • In-Memory Ring Buffer: Places incoming events into an in-memory queue. A background thread flushes events in atomic batches. Recommended for large fleets (> 50 nodes).
  • Batch Flush Interval: Time in seconds between automated queue commits (default: 2.0s).
  • Batch Size: Maximum events processed per database commit transaction (default: 100).
  • Note: Ingestion buffering is an explicit opt-in setting and is not auto-enabled.

2. Payload Encryption at Rest (Middle Section)

  • Encrypt Payloads at Rest: When enabled, log message payloads (event_data) stored in external databases are encrypted using the server's X.509 RSA-2048 / OpenPGP public key.
  • Zero-Knowledge Guarantee: Database administrators or compromised SQL servers cannot read raw logs without the private key resident on the LOGAR Server Hub.
  • Note: Encryption at rest is an explicit opt-in setting.

3. Database Backend Selection (Bottom Section)

Switch between local file storage and external SQL servers:

  • Local SQLite (WAL Mode):
    • Default, zero-configuration embedded database located at logar_state.db.
    • Operates with Write-Ahead Logging (WAL) for high concurrency.
  • External SQL Server (PostgreSQL / MySQL / MariaDB):
    • Select your database dialect (PostgreSQL or MySQL / MariaDB).
    • Enter Host, Port, Database Name, Username, and Password.
    • Click 💾 Save & Apply Storage Configuration.
    • The server tests connectivity, initializes required tables and indices, and migrates operational state seamlessly.
  • Licensing Note: External SQL backend options require the enterprise_db licensed capability. If unlicensed, these controls are visible but gracefully disabled.

6. Hermes AI Tokens & Integration

Tab: 🤖 Hermes AI

Provision dedicated access tokens for Hermes AI agents to ingest anomalous telemetry.

Managing Access Tokens

  • Create Token: Enter an agent name (e.g. Hermes-Production-Cluster) and click ➕ Generate Token.
  • Token Attributes: View Token Name, Creation Date, Last Used Timestamp, and Status (Active / Revoked).
  • Revoke / Delete: Instantly revoke access for compromised tokens or permanently delete retired tokens.

Connecting Hermes AI

Configure Hermes AI agents to query the structured anomaly stream:

GET http://<SERVER_IP>:8443/api/hermes/report
Authorization: Bearer hermes_live_xxxxxxxxxxxxxxxx
  • Or via query parameter: http://<SERVER_IP>:8443/api/hermes/report?token=hermes_live_xxxxxxxxxxxxxxxx

7. User Account & 2FA Security

Menu: ⚙️ User Settings

Changing Administrative Credentials

  1. Click the Admin Profile icon in the navigation bar.
  2. Enter a new Username and Password.
  3. Click Update Account.

Two-Factor Authentication (TOTP 2FA)

Enhance login security with RFC 6238 Time-Based One-Time Passwords:

  1. Click 🔒 Setup Two-Factor Authentication.
  2. Scan the displayed QR Code using your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.).
  3. Enter the 6-digit verification code from your authenticator app to confirm activation.
  4. Subsequent logins will require your password followed by the 6-digit TOTP code.
Reference in New Issue View Git Blame Copy Permalink