LOGAR Documentation Wiki

Welcome to the official technical documentation wiki for LOGAR: Fleet Log Aggregation & Centralized Provisioning System.

WebUI Administrator Guide
- Accessing the management console & credentials
- Live verified anomaly telemetry stream & filtering
- Fleet seat management & client profile export
- Sub-CA certificates, modular licensing & WebSocket sync
- Ingestion ring buffer tuning & payload encryption at rest
- Database engine management (SQLite WAL / PostgreSQL / MySQL)
- Hermes AI token provisioning & TOTP 2FA security
Architecture and Design
- Core philosophy & data provisioning model
- End-to-end system architecture
- Zero-state edge forwarders vs centralized hub
- Hermes AI reasoning integration
State Machines and Lifecycles
- End-to-end high-level system state machine
- Sub-CA bootstrap & auto-enrollment lifecycle
- Live WebSocket synchronization & in-flight hot reload
- Forwarder identity discovery & zero-touch enrollment
- mTLS 1.3 streaming, proactive renewal & self-healing
- 12-hour temporal evaluation window
PKI and Fleet Licensing
- Hierarchical PKI architecture & custom X.509 OIDs
- Dynamic seat quotas and licensing enforcement
- Bootstrap .lic package handling
- In-flight certificate watchdog & hot SSLContext reloading
- WebUI Sub-CA & Licensing dashboard
API Reference
- REST API specifications & JSON request/response schemas
- Forwarder enrollment (/api/client/enroll)
- Seat management & client telemetry (/api/clients)
- Hermes AI log streaming (/api/hermes/report)
- Administrator session authentication & health endpoints
Deployment and Installation
- Central server hub setup & configuration
- Linux client deployment (install_linux_client.sh)
- Windows client & server setup (Inno Setup & NSSM)
- Dynamic machine and domain identification
Testing and Releases
- Automated unit test suite (51 tests) & end-to-end pipeline test
- Continuous Integration (ci.yml)
- Automated cross-compilation release workflow (release.yml)
- Local binary packaging & Gitea asset publisher
Branding and Asset Guide
- Visual identity, logo geometry & color palette
- Asset inventory, icons, and installer graphics
- Logo usage rules, dos and don'ts, and asset regeneration

High-Level Architecture Overview

graph TB
    subgraph Authority [Master License Authority - logar.eibl.tech]
        M_CA[Master Root CA<br/>RSA-4096 / SHA-256]
        AUTH_WS[WebSocket Licensing Hub<br/>/ws/license]
        AUTH_DB[(Authority DB<br/>Tenants, Users, 2FA, Seats)]
        AUTH_UI[Authority WebUI<br/>User Mgmt & Fleet Quotas]
        AUTH_WS --- AUTH_DB
        AUTH_UI --- AUTH_DB
    end

    subgraph ServerHub [LOGAR Server Hub - Central Aggregation & Provisioning]
        SUB_CA[Subordinate CA<br/>Signed with Seat OID 1.3.6.1.4.1.59999.1.1]
        SEAT_MGR[Dynamic Seat Manager<br/>Enforces Seat Quota in SQLite]
        MTLS_SRV[mTLS 1.3 Ingestion Server<br/>Port 9443 - ssl.CERT_REQUIRED]
        TEMP_ENG[12h Temporal Persistence Engine<br/>Correlates First/Last Seen & Run Counts]
        HUB_DB[(logar_state.db<br/>active_issues, clients, config)]
        PROV_API[Log Provisioning & Hermes API<br/>Port 8443 - GET /api/hermes/report]
        
        SUB_CA --> SEAT_MGR
        SEAT_MGR --> MTLS_SRV
        MTLS_SRV --> TEMP_ENG
        TEMP_ENG --> HUB_DB
        HUB_DB --> PROV_API
    end

    subgraph EdgeNodes [Heterogeneous Edge Forwarders]
        WIN[Win_Client.exe / Win_Client.py<br/>Windows Event Log Ingestion]
        LIN[Linux_Client.bin / Linux_Client.py<br/>systemd journalctl -p warning]
    end

    subgraph Downstream [Hermes AI Reasoning Layer]
        HERMES[Hermes AI Engine<br/>Autonomous Analysis & Remediation]
    end

    %% PKI & Licensing Relationships
    M_CA -->|Signs Sub-CA Cert via /ws/license| SUB_CA
    AUTH_WS <==>|Bidirectional Sync & Live Seat Expansion| SUB_CA
    
    %% Forwarder Enrollment & mTLS Transport
    WIN -->|1. Auto-Enrollment POST /api/client/enroll| SUB_CA
    LIN -->|1. Auto-Enrollment POST /api/client/enroll| SUB_CA
    SUB_CA -->|2. Issues Client Cert & Root Trust| WIN
    SUB_CA -->|2. Issues Client Cert & Root Trust| LIN
    
    WIN ==>|3. Continuous mTLS 1.3 Stream :9443| MTLS_SRV
    LIN ==>|3. Continuous mTLS 1.3 Stream :9443| MTLS_SRV

    %% Log Provisioning & Hermes Consumption
    PROV_API ==>|Centralized Log Delivery| HERMES

LOGAR Documentation Wiki

Navigation & Wiki Index

High-Level Architecture Overview