me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity
Page: Admin Guide
Pages
API Reference Admin Guide Architecture and Design Branding Guide Deployment and Installation Home PKI and Licensing State Machines and Lifecycles Testing and Releases
Clone
1
Admin Guide
max edited this page 2026-09-30 18:08:32 +02:00
Unescape Escape
Table of Contents
This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

WebUI Administrator Guide

Welcome to the LOGAR WebUI Administrator Guide. This guide provides step-by-step instructions for managing and operating the LOGAR Server Hub through its graphical web console (:8443/webui).

For deep architectural design, cryptographic protocols, X.509 OID schemas, and full REST API specifications, please refer to the dedicated technical wiki pages:

Table of Contents

  1. Accessing the Web Console & Authentication
  2. Dashboard: Live Verified Telemetry
  3. Fleet Seat Management & Client Provisioning
  4. Sub-CA & Modular Licensing
  5. Storage Engine & Ingestion Performance
  6. Hermes AI Tokens & Integration
  7. User Account & 2FA Security

1. Accessing the Web Console & Authentication

The LOGAR Server Hub provides an authenticated web management portal accessible from any modern web browser.

URL & Port

  • Management Console URL: http://<SERVER_IP>:8443/webui
  • Protocol: HTTP (or HTTPS behind an enterprise reverse proxy / load balancer)

Default Credentials

Upon first launch, LOGAR initializes default administrative credentials:

  • Username: admin
  • Password: admin_logar_2026!

Security Recommendation: Change the default credentials immediately after initial deployment using the User Settings menu.

2. Dashboard: Live Verified Telemetry

Tab: 📊 Live Telemetry

The Live Telemetry view displays real-time anomalous log events aggregated across all enrolled Windows and Linux edge forwarders.

Key Controls & Information

  • Severity Filter: Filter events by ALL, CRITICAL, ERROR, or WARNING.
  • Temporal Tracking: View occurrence frequency (Runs: N), first seen timestamp, and relative last seen time (e.g. 2m ago).
  • Source Attribution: Inspect originating Hostname, Machine GUID, and Operating System badge (Windows / Linux).
  • Message Payload: Inspect the raw extracted log message and normalized signature.
  • Auto-Refresh: Live stream updates automatically; displays the latest 50 active anomaly frames.

3. Fleet Seat Management & Client Provisioning

Tab: 💻 Client Seats

Manage connected edge forwarders (Win_Client and Linux_Client), enforce cryptographic seat quotas, and export client configuration profiles.

Seat Quota Overview

  • Displays the current seat consumption ratio (e.g., 3 / 25 Seats in Use).
  • Unlicensed servers allow local log collection (0 / 0 Seats) while blocking remote mTLS forwarders until a license is imported.

Managing Enrolled Forwarders

The client seat table lists every registered forwarder with its Machine Identifier, Hostname, OS Type, IP Address, First Enrolled date, and Status:

  • 🟢 Active: The forwarder has valid mTLS certificates and is actively streaming logs.
  • 🔴 Revoked: The forwarder's mTLS certificate has been administratively revoked. Ingestion from this client is rejected.
  • Action Buttons:
    • Revoke: Temporarily revoke a client's seat and deny incoming connections.
    • Reactivate / Approve: Re-enable a previously revoked client seat.
    • Delete: Remove the client record and release the seat back to the available pool.

Exporting Client Configuration

Click 📥 Download Client Config to generate and download client_config.json.

  • Contains the server's connection endpoints (server_host:9443), Sub-CA public certificate, encryption fingerprint, and enrollment secret.
  • Distribute this file to edge forwarders during deployment for instant zero-touch auto-enrollment.

4. Sub-CA & Modular Licensing

Tab: 📜 Sub-CA & Licensing

Manage the server's Subordinate Certificate Authority (Sub-CA), verify hardware host binding, view active licensed capabilities, and apply license updates.

Sub-CA Status & Fingerprints

  • CA Subject: The Distinguished Name (DN) of the local Sub-CA.
  • Server Encryption Fingerprint: SHA-256 / OpenPGP fingerprint for encrypted payloads.
  • Validity Period: Issue date and certificate expiration date.
  • Assigned Seat Quota: Maximum authorized forwarder capacity.

✨ Licensed Capabilities & Feature Modules

This section displays all authorized feature modules:

  • enterprise_db: Multi-engine external database support (PostgreSQL / MySQL / MariaDB), high-throughput ring buffering, and zero-knowledge data encryption at rest.
  • Standard Edition: If running without an enterprise license, standard local SQLite storage remains active.

License Management Operations

  • Export License Request (.lic): Click 📤 Export CSR (.lic) to download the server's hardware-bound certificate signing request. Send this file to your organization's Master License Authority administrator.
  • Import Signed Sub-CA Certificate: Paste the signed PEM certificate received from the Master Authority into the text area and click 📥 Import Signed Certificate. The server reloads its SSLContext and updates seat quotas in-flight with zero downtime.
  • Live WebSocket Sync: Click 🔄 Sync with License Hub to trigger immediate real-time synchronization with logar.eibl.tech.

5. Storage Engine & Ingestion Performance

Tab: 🗄️ Database Engine

Configure ingestion buffering, payload encryption at rest, and database backends.

┌─────────────────────────────────────────────────────────────┐
│ 1. INGESTION RING BUFFER & BATCH FLUSHER (Top)              │
│    • Mode: Direct (Sync) / In-Memory Ring Buffer            │
│    • Batch Flush Interval (sec) & Batch Size (events)       │
├─────────────────────────────────────────────────────────────┤
│ 2. PAYLOAD ENCRYPTION AT REST (Middle)                      │
│    • Toggle: OpenPGP / RSA-2048 Payload Encryption          │
├─────────────────────────────────────────────────────────────┤
│ 3. STORAGE BACKEND SELECTION (Bottom)                       │
│    • Local SQLite (WAL Mode)                                │
│    • External SQL Server (PostgreSQL / MySQL / MariaDB)     │
└─────────────────────────────────────────────────────────────┘

1. Ingestion Ring Buffer (Top Section)

Tune log ingestion throughput to prevent socket I/O bottlenecks during high-volume spikes:

  • Cache Mode:
    • Direct (Synchronous): Commits incoming log batches immediately to disk. Recommended for small deployments (< 20 nodes).
    • In-Memory Ring Buffer: Places incoming events into an in-memory queue. A background thread flushes events in atomic batches. Recommended for large fleets (> 50 nodes).
  • Batch Flush Interval: Time in seconds between automated queue commits (default: 2.0s).
  • Batch Size: Maximum events processed per database commit transaction (default: 100).
  • Note: Ingestion buffering is an explicit opt-in setting and is not auto-enabled.

2. Payload Encryption at Rest (Middle Section)

  • Encrypt Payloads at Rest: When enabled, log message payloads (event_data) stored in external databases are encrypted using the server's X.509 RSA-2048 / OpenPGP public key.
  • Zero-Knowledge Guarantee: Database administrators or compromised SQL servers cannot read raw logs without the private key resident on the LOGAR Server Hub.
  • Note: Encryption at rest is an explicit opt-in setting.

3. Database Backend Selection (Bottom Section)

Switch between local file storage and external SQL servers:

  • Local SQLite (WAL Mode):
    • Default, zero-configuration embedded database located at logar_state.db.
    • Operates with Write-Ahead Logging (WAL) for high concurrency.
  • External SQL Server (PostgreSQL / MySQL / MariaDB):
    • Select your database dialect (PostgreSQL or MySQL / MariaDB).
    • Enter Host, Port, Database Name, Username, and Password.
    • Click 💾 Save & Apply Storage Configuration.
    • The server tests connectivity, initializes required tables and indices, and migrates operational state seamlessly.
  • Licensing Note: External SQL backend options require the enterprise_db licensed capability. If unlicensed, these controls are visible but gracefully disabled.

6. Hermes AI Tokens & Integration

Tab: 🤖 Hermes AI

Provision dedicated access tokens for Hermes AI agents to ingest anomalous telemetry.

Managing Access Tokens

  • Create Token: Enter an agent name (e.g. Hermes-Production-Cluster) and click ➕ Generate Token.
  • Token Attributes: View Token Name, Creation Date, Last Used Timestamp, and Status (Active / Revoked).
  • Revoke / Delete: Instantly revoke access for compromised tokens or permanently delete retired tokens.

Connecting Hermes AI

Configure Hermes AI agents to query the structured anomaly stream:

GET http://<SERVER_IP>:8443/api/hermes/report
Authorization: Bearer hermes_live_xxxxxxxxxxxxxxxx
  • Or via query parameter: http://<SERVER_IP>:8443/api/hermes/report?token=hermes_live_xxxxxxxxxxxxxxxx

7. User Account & 2FA Security

Menu: ⚙️ User Settings

Changing Administrative Credentials

  1. Click the Admin Profile icon in the navigation bar.
  2. Enter a new Username and Password.
  3. Click Update Account.

Two-Factor Authentication (TOTP 2FA)

Enhance login security with RFC 6238 Time-Based One-Time Passwords:

  1. Click 🔒 Setup Two-Factor Authentication.
  2. Scan the displayed QR Code using your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.).
  3. Enter the 6-digit verification code from your authenticator app to confirm activation.
  4. Subsequent logins will require your password followed by the 6-digit TOTP code.