Architecture and Design

LOGAR is engineered as a zero-state, high-throughput log aggregation and provisioning system designed for enterprise server fleets comprising both Windows and Linux hosts.

1. Core Design Philosophy

Centralized Log Aggregation & Zero-State Edge

Edge agents (Win_Client and Linux_Client) follow a strict zero-state architecture:

Zero Local Databases: Edge forwarders do not maintain local SQLite databases or persistent files on disk.
Zero Disk Buffering: Log events are filtered, formatted in memory, and immediately streamed over mTLS 1.3 sockets.
Fail-Safe Self-Healing: In the event of network disconnection, connection reset, or CA rotation, clients re-establish connections or re-enroll automatically without state corruption or data loss.

Direct Hermes Intelligence

LOGAR decouples data aggregation and delivery from semantic log analysis:

No Arbitrary Edge Filtering: All anomalous log events (WARNING, ERROR, CRITICAL) within the active 12-hour evaluation window are ingested and normalized.
Hermes AI Reasoning: Hermes AI queries the centralized server hub (GET /api/hermes/report) and applies multi-factor reasoning, cross-system correlation, severity ranking, and autonomous remediation actions directly on verified telemetry.

2. Component Subsystems

Edge Forwarders

Windows Client (Win_Client.exe / Win_Client.py):
- Queries Windows Event Logs (System, Application, Security) via win32evtlog.
- Normalizes Windows event categories into standard severity levels (INFO, WARNING, ERROR, CRITICAL).
- Dynamic host/domain identification via Active Directory environment variables.
Linux Client (Linux_Client.bin / Linux_Client.py):
- Ingests system logs via systemd journalctl -p warning..emerg --output=json.
- Strips noisy trace entries and parses unit attribution.
- Dynamic host/domain identification via /etc/resolv.conf and canonical DNS resolution.

Central Server Hub (`Server.py`)

mTLS 1.3 Ingestion Engine (Port 9443):
- Enforces bidirectional TLS 1.3 with mutual certificate verification (ssl.CERT_REQUIRED).
- Validates client certificates against the Subordinate CA in real time.
- Checks active seat status on every handshake and drops revoked edge nodes.
Temporal Persistence Engine:
- Tracks active anomalies in SQLite (active_issues).
- Formats unique fingerprints: {site_name}:{server}:{signature}.
- Maintains consecutive run counts within a rolling 12-hour evaluation window.
Log Provisioning REST API (Port 8443):
- Exposes clean, verified log telemetry to Hermes AI via /api/hermes/report.
- Provides administrator WebUI and seat management endpoints.

3. Data Flow

sequenceDiagram
    autonumber
    participant Edge as Edge Forwarder (Win/Linux)
    participant Hub as LOGAR Server Hub
    participant DB as logar_state.db
    participant Hermes as Hermes AI Engine

    Edge->>Hub: TLS 1.3 Handshake (Client Cert :9443)
    Hub->>DB: Check client_id status (active?)
    DB-->>Hub: Approved (Seat valid)
    Hub-->>Edge: TLS Handshake OK

    loop Streaming Logs
        Edge->>Hub: Stream JSON Log Frame ({site, server, signature, msg})
        Hub->>DB: Upsert active_issues (Update run_count & last_seen)
    end

    Hermes->>Hub: GET /api/hermes/report (:8443)
    Hub->>DB: SELECT verified issues within 12h window
    DB-->>Hub: Return active issue records
    Hub-->>Hermes: 200 OK [JSON Telemetry Stream]
    Hermes->>Hermes: Deep Reasoning & Automated Remediation