Getting Started Guide:

LogRhythm Windows Appliance Software Configuration

After you complete the hardware installation of your LogRhythm Windows Appliance, this document will guide
you through the initial configuration of your LogRhythm deployment.

IMPORTANT: Please work with your LogRhythm Professional Services Consultant to complete the procedures
outlined in this guide.

Prerequisites
Before starting your configuration, you will need:
• The LogRhythm License file (.LIC), usually provided in an email
• The factory default password for your deployment

Configure and Start LogRhythm Components

Configure Platform Manager Services

1. On the Start Menu, click  to open Apps, and then click Platform Manager Configuration Manager.

2. On the Job Manager tab, complete the following fields:

• Server – the name or IP address of the Platform Manager database server

• Password – the factory default password

3. On the Alarming and Response Manager tab, complete the following fields:

• Server – the name or IP address of the Platform Manager database server

• Password – the factory default password

4. Click OK.

Configure Data Processor Service

1. On the Start Menu, click  to open Apps, and then click Data Processor Configuration Manager.

2. On the General tab, complete the following fields:

• Server – the name or IP address of the Platform Manager database server

• Password – the factory default password

3. Click OK.

© LogRhythm, Inc. All rights reserved Page 1 of 18

Configure System Monitor Agent Service
1. On the Start Menu, click  to open Apps, and then click System Monitor Configuration Manager.

2. On the General tab, complete the following fields:

• Server – the name or IP address of the Data Processor server

• System Monitor IP Address – the IP address of the System Monitor

• Host Entity ID – default is zero for system assigned ID

3. Click OK.

Log in to the Client Console

1. On the Start Menu, click  to open Apps, and then click LogRhythm Console.

2. Complete the following fields:

• User ID – logrhythmadmin

• Password – the factory default password

3. Click OK.

Complete New Deployment Wizard

Enter the following information in the New Deployment Wizard:
1. Windows host name of the Platform Manager

a. Enter the host name where the Platform Manager is located. This can be found by right-clicking My
Computer and selecting Properties. Click the Computer Name tab and get the Full Computer Name
up to the first period where the domain name will start.

b. If the appliance type is XM, all LogRhythm components are contained in a single appliance.

2. IP address of the Platform Manager

Enter the IP address where the Platform Manager is located. Appliances are shipped with two Network
Interface Cards (NICs). Typically, one NIC is used for Console connections, while the other NIC is used for
database intercommunications. The IP address entered here will serve as a Console connection interface.

© LogRhythm, Inc. All rights reserved Page 2 of 18

 3. The Platform Manager is also a Data Processor (e.g., an XM appliance)
If this is an XM Appliance — all LogRhythm components are contained in a single appliance — select this
checkbox.

4. The Platform Manager is also an AI Engine Server

If AI Engine is installed on the Platform Manager — not deployed as a standalone appliance — select this
checkbox.

5. LogMart DB Server Override

If the LogMart database is installed on a different host, enter the host IP address here.

6. LogRhythm License file

Note: This file is provided by LogRhythm Support after purchase and shipment of the appliance(s), and it
is required to access and configure LogRhythm.

a. Navigate to the location of the license file (*.lic) by clicking the ellipses at the far right.

b. Locate and select the master license file and click Open. The path and file name are listed in the
License File text box.

c. Click OK.

8. When prompted, select the appropriate Data Processor licensing mode from the available, valid
options. The mode depends on:

a. Software (n available licenses) - Select this option to identify a software only purchase

b. Appliance Mode for software and appliance purchase - Select this option to identify a software
and appliance purchase

c. Data Processor MPS mode for software and appliance purchase - Select this option to use a
Messages Per Second license

9. Click Next.

© LogRhythm, Inc. All rights reserved Page 3 of 18

 10. You are prompted to select the Log Source licensing mode from the available valid options: Limited or
Unlimited.

11. Select the appropriate mode, and then click OK.

All dialog boxes close and the main Client Console window is displayed.

© LogRhythm, Inc. All rights reserved Page 4 of 18

Complete Knowledge Base Import Wizard
After completing the New Deployment Wizard, the New Knowledge Base Deployment Wizard is displayed.

1. Deploy the Knowledge Base by selecting one of the three following options:
• I have Internet access and want to automatically download the KB (recommended).
a. Proxy Server Address - Enter the Proxy Server Address for the KB Download
b. Proxy Server Port - Enter the port number for the server
c. Select the Proxy Server Requires Authentication check box
d. Enter the appropriate credentials and Host name, if necessary
e. Click OK. The Knowledge Base is downloaded.
f. Click OK. Proceed to the Knowledge Base Importer Wizard section.
• I do not have Internet access or want to manually download the KB.
The Manual Knowledge Base Download window appears.

© LogRhythm, Inc. All rights reserved Page 5 of 18

 Perform one of the following steps:
• Export Knowledge Base Request File - Select this option to export a Knowledge Base request file
and upload it to the Support Portal:
i. Click OK and download the file to your drive. The Export Successful page appears.
ii. Click OK. The Knowledge Base Not Loaded page appears.
iii. Click OK and the Console closes.
• Contact Customer Support - Select this option to obtain the Knowledge Base file from Customer
Support:
i. From a computer with Internet access, log into the Support Portal at
https://support.logrhythm.com.
ii. Go to the Downloads to section to access the latest version of the Knowledge Base.
The request screen displays.

iii. Choose from the following:

a. Upload the Request File downloaded from the Console
b. Enter the License ID, the Deployment ID, and the Product Version
iv. Click Get Knowledge Base.
v. Save the Knowledge Base file and transfer it to the computer on which you are loading the
Console.
vi. Restart the Console and follow the instructions in the “I have already manually
downloaded the KB section.”

© LogRhythm, Inc. All rights reserved Page 6 of 18

 • I have already manually downloaded the KB - Select this option to manually import the
Knowledge Base file.
i. The Knowledge Base Export Wizard appears and starts unpacking and validating the
Knowledge Base file. The file is checked for compatibility with your current deployment
and is prepared for import. This may take several minutes.

ii. Upon completion the message Knowledge Base unpacked appears in the status. Click Next
to import the Knowledge Base.

2. When the Knowledge Base Updated message is displayed, click OK.

3. On the Knowledge Base Import Wizard, click Close.

© LogRhythm, Inc. All rights reserved Page 7 of 18

Configure the Platform
After completing the Knowledge Base import, the Missing Platform Manager Platform message is displayed.

1. Click OK.
2. In the Platform Manager Properties dialog box, click the browse icon next to the Platform box.

3. In the Platform Selector table, select the row corresponding to your appliance, and then click OK.

4. Enter the Email From Address, and then click OK.

© LogRhythm, Inc. All rights reserved Page 8 of 18

 The Missing Data Processor Platform error message is displayed.

5. Click OK.
6. In the Data Processor Properties dialog box, click the browse icon next to the Platform box.

7. In the Platform Selector table, select the row corresponding to your appliance, and then click OK.

8. The Restart Component message is displayed.

9. Click OK.

© LogRhythm, Inc. All rights reserved Page 9 of 18

Specify Advanced Data Processor Properties
1. In the Data Processor Properties dialog box, click Advanced.

The Data Processor Advanced Properties dialog box is displayed.

2. Change the ActiveArchivePath from C:\LogRhythmArchives\Active to D:\LogRhythm Archives\Active.

3. Change the InactiveArchivePath from C:\LogRhythmArchives\Inactive to D:\LogRhythmArchives\Inactive.

4. Click OK.

The Restart Component message is displayed.

5. Click OK.

Start the Platform Manager Services

1. Click the Platform Manager tab.

2. Click Start.

Start the Data Processor Services

1. Click the Data Processors tab.

2. Select the Action box next to your Data Processor.

3. Right-click the selected Data Processor, click Actions, and then click Service Start.

Start the System Monitor Agents Services

1. Click the System Monitors tab.

2. Select the Action box next to the System Monitor Agent.

3. Right-click the selected System Monitor, click Actions, and then click Service Start.

The System Monitor Agent is displayed in the top pane and listed as pending.

4. Select the Action box next to the pending Agent.

5. Right-click the selected Agent, and then click Associate.

The “Associate New System Monitor Agent with an Existing Agent” message is displayed.

6. Select the Agent and click OK.

The “Associate Successful” message is displayed.

7. Click OK.

© LogRhythm, Inc. All rights reserved Page 10 of 18

Configure the Data Indexer
Accessing and configuring the Data Indexer differs slightly between Windows and Linux. Please refer to the
appropriate procedure below according to your Data Indexer operating system.

Configure the Data Indexer on Windows

NOTE: You must perform these steps for each Data Indexer (XM or DPX) in your deployment. Ensure that the
LogRhythm DX – AllConf and LogRhythm DX – Configuration Server services are running before
trying to connect to the Data Indexer.

Configure the Data Indexer via the configuration web page hosted on the Data Indexer. Please note the following
requirements:
• On a Windows Data Indexer, you can only access the web page locally or through a remote
desktop/terminal services session to the appliance
• You can only access the web page using Google Chrome, Mozilla Firefox (latest versions of each), or
Internet Explorer 11.
NOTE: Do not attempt to modify any configuration files. If you have any issues, please contact
LogRhythm Support.
To access the web page and configure the Data Indexer, do the following:
1. Log in to the DPX appliance as an administrator.
2. Start one of the supported Internet browsers.
3. Type the following in the address bar: localhost:9100
The Data Indexer Configuration sign in page is displayed.

4. Type admin in the Username box and the LogRhythm default password in the Password box, and then
click Sign In.

© LogRhythm, Inc. All rights reserved Page 11 of 18

 5. Modify or verify the following settings:
Anubis Config
Anubis sends logs to the Mediator in batches. The frequency at which batches are sent is determined by
the Accumulator Conf settings shown below. A batch of logs will be sent when any one of the following
thresholds is met: Entries to Accumulate, Max Batch Size Bytes, or Seconds To Accumulate
NOTE: The default values assume 1500 byte logs and should work well for most indexing rates.
Parameter Value
Accumulator Conf
Entries to Accumulate The number of logs to accumulate before sending to the Mediator. The default is 50,000.
Max Batch Size Bytes The maximum size in bytes that a batch of logs can become before sending to the Mediator. The
default is 15,000,000.
Max Log Size Bytes This can be left at the default value of 1,000,000.
Seconds To Accumulate The maximum amount of time in seconds to wait before sending to the Mediator. The default is 5.
Gigawatt DB Config
Gigawatt Db Path This is the path to the database used for messaging within the Indexer system.
NOTE: You can use any directory you want for Gigawatt Db, but it should not be on the C: drive.
You should overwrite the default and change it to something like the following:
D:\Logrhythm\data indexer\gigawatt\db

Relay Config
These values can be left at their defaults.

Carpenter Config
Parameter Value
Db Password This is the password used by the LogRhythmNGLM SQL account. Services on the Data Indexer use this account
to connect to the EMDB and read/update tables.
NOTE: It is highly recommended and LogRhythm best practice to change all MS SQL account passwords
when setting up a deployment. After you change the LogRhythmNGLM password in Microsoft SQL
Server Management Studio, you must set Db Password to the same value. You should change the
password in Microsoft SQL Server Management Studio first, then change it on the Data Indexer
page.

Db Username This should be left unchanged unless you have renamed the LogRhythmNGLM SQL account in SQL Server
Management Studio.
Emdb Host This must be set to the external IP address of your Platform Manager appliance, where the EMDB database is
hosted.
Minutes To Rest This can be left at the default value.
Sql Paging Size This can be left at the default value.

Cluster Node Config

Parameter Value
Node Info[n]
Hostname Cannot be changed
Public IP This must be set to the external IP address of your DPX appliance or server.

© LogRhythm, Inc. All rights reserved Page 12 of 18

 Elasticsearch Server Config
Parameter Value
Elasticsearch Server Settings[n]
Name cluster.name
Value If you only have one DPX appliance, you can leave this value at the default (logrhythm). If you have more than
one DPX appliance, change this value so that each cluster name is unique. For example, logrhythm01,
logrhythm02, and logrhythm03.
The cluster name for each DPX appliance must be different. When you have finished making changes on the
Data Indexer Configuration page, ensure that you assign the correct cluster to each Data Processor. For
multiple DPX appliances, ensure that the cluster is assigned to the Data Processor running on the same
appliance.
For example, if clusters are named as follows: DPX-A = dxa, DPX-B = dxb, and DPX-C = dxc, Data Processor A
should point to cluster dxa, Data Processor B should point to cluster dxb, and Data Processor C should point to
cluster dxc.

Elasticsearch Server Settings[n]

Name path.data
Value ${DXDATAPATH}\elasticsearch\data
${DXDATAPATH} is a system variable that is created when the Data Indexer is installed. By default,
${DXDATAPATH} is set to C:\Program Files\LogRhythm\Data Indexer. This means the default data path is
C:\Program Files\LogRhythm\Data Indexer\elasticsearch\data.
NOTE: You can use any directory you want for storing Elasticsearch data, but it should not be on the C:
drive.
You should overwrite the default and change it to something like the following:
D:\LRIndexer\elasticsearch\data.
If you have more than one drive for data, you can specify multiple locations in the following format:
D:\LRIndexer\elasticsearch\data,E:\LRIndexer\elasticsearch\data

6. Click Submit.
Your changes will be pushed to the appropriate appliances and database tables, and all of the required
Data Indexer services will start or restart.

© LogRhythm, Inc. All rights reserved Page 13 of 18

Configure the Data Indexer on Linux
Whether your Linux Data Indexer cluster is one node or 3 to 10 nodes, you only have to log in to the configuration
page on one of the nodes. Please note the following requirements:
• On a Linux Data Indexer, you can only access the web page from an external computer that has access to
the Data Indexer network.
• You can only access the web page using Google Chrome, Mozilla Firefox (latest versions of each), or
Internet Explorer 11.
NOTE: Do not attempt to modify any configuration files. If you have any issues, please contact
LogRhythm Support.
To access the web page and configure the Linux cluster, do the following:
1. Log in to a Windows server with network access to the Data Indexer nodes.
2. Start one of the supported Internet browsers.
3. Type the IP address of one of the cluster nodes in the address bar, and then press Enter.
The Data Indexer Configuration page is displayed.

4. Type admin in the username box and the LogRhythm default password in the password box, and then
click Sign In.

© LogRhythm, Inc. All rights reserved Page 14 of 18

 5. Modify or verify the following settings:
Anubis Config
Anubis sends logs to the Mediator in batches. The frequency at which batches are sent is determined by
the Accumulator Conf settings shown below. A batch of logs will be sent when any one of the following
thresholds is met: Entries to Accumulate, Max Batch Size Bytes, or Seconds To Accumulate
NOTE: The default values assume 1500 byte logs and should work well for most indexing rates.
Parameter Value
Accumulator Conf
Entries to Accumulate The number of logs to accumulate before sending to the Mediator. The default is 50,000.
Max Batch Size Bytes The maximum size in bytes that a batch of logs can become before sending to the Mediator. The
default is 15,000,000.
Max Log Size Bytes This can be left at the default value of 1,000,000.
Seconds To Accumulate The maximum amount of time in seconds to wait before sending to the Mediator. The default is 5.
Gigawatt DB Config
Gigawatt Db Path This can be left at the default value.

Relay Config
These values can be left at their defaults.

Carpenter Config
Parameter Value
Db Password This is the password used by the LogRhythmNGLM SQL account. Services on the Data Indexer use this account
to connect to the EMDB and read/update tables.
NOTE: It is highly recommended and LogRhythm best practice to change all MS SQL account passwords
when setting up a deployment. After you change the LogRhythmNGLM password in Microsoft SQL
Server Management Studio, you must set Db Password to the same value. You should change the
password in Microsoft SQL Server Management Studio first, then change it on the Data Indexer
page.

Db Username This should be left unchanged unless you have renamed the LogRhythmNGLM SQL account in SQL Server
Management Studio.
Emdb Host This is the external IP address of your Platform Manager appliance, where the EMDB database is hosted. If you
leave the default value of 127.0.0.1, the Data Indexer services will attempt to connect locally to the EMDB, but it
does not exist locally.
Minutes To Rest This can be left at the default value.
Sql Paging Size This can be left at the default value.

Cluster Node Config

Parameter Value
Node Info[n]
Hostname Cannot be changed
Public IP For each node, this must be set to the external IP address of your Data Indexer appliance or server.

© LogRhythm, Inc. All rights reserved Page 15 of 18

 Elasticsearch Server Config
Parameter Value
Elasticsearch Server Settings[n]
Name cluster.name
Value If you only have one cluster, you can leave this value at the default: logrhythm
If you have more than one cluster, change this value so that each cluster name is unique. For example,
logrhythm01, logrhythm02, and logrhythm03.

6. Click Submit.
Your changes will be pushed to the appropriate appliances and database tables, and all of the required
Data Indexer services will start or restart.

Information about Automatic Maintenance

Automatic maintenance is governed by several settings in Go Maintain Config:
• diskUtilLimt indicates the percentage of disk utilization that triggers maintenance. The default is 80, which
means that maintenance will start when the Elasticsearch data disk is 80% full.
• indexConfigs[0]: Min indicates the absolute minimum number of indices that are required for the active
repository. The default is 2.
Maintenance is applied to the active repository, as well as archive repositories created by Second Look. When the
Disk Usage Limit (diskUtilLimit: 80) is reached, active logs are trimmed when “max indices” is reached. Then Go
Maintain deletes completed restored repositories starting with the oldest date.
The default settings prioritize restored repositories above the active log repository. Restored archived logs will be
maintained at the sacrifice of active logs.
If you want to keep your active logs and delete archives for space, set your min indices equal to your max indices.
This will force the maintenance process to delete restored repositories first.

© LogRhythm, Inc. All rights reserved Page 16 of 18

Assign the Data Processor to a Data Indexer Cluster
Every Data Indexer is considered to be part of a cluster, even if only a cluster of one. In LogRhythm 7.x, a new
configuration option is available to assign the Data Processor to a cluster.

NOTE: You should assign all Data Processors to a cluster, offline, active, and archive. If you need to restore any
data using SecondLook, the archive Data Processors must be assigned to a cluster.

To assign the Data Processor to a cluster, do the following:

1. Log in to a system where the LogRhythm 7.1.5 Client Console is installed.
2. Start the Client Console and click Deployment Manager.
3. Click the Data Processors tab.
The Data Processor Properties dialog box is displayed.

4. Select a cluster from the Cluster Name list, and then click OK.

NOTE: Cluster information is sent out when applying configuration changes on the Data Indexer. Refer to
Configure the Data Indexer for more information.

© LogRhythm, Inc. All rights reserved Page 17 of 18

Verify Appliance Functionality
1. Verify Log Collection via Tail (see “Configure a New Tail” in the application Help).

2. Ensure log data is being received by viewing the log data in the Tail display.

3. Configure the Tail to query all available log sources for the last 24 hours. Do not configure any filters.

4. Ensure logs are being processed by double-clicking a row in the Log/Event List pane, and checking for
metadata parsing and classification. It is sufficient to just verify that there is some data loaded into the
fields on the Processed Metadata Fields tab.

5. Verify Event Forwarding by opening the Personal Dashboard and viewing events as they arrive.

6. Visually check system health and status by opening the Deployment Monitor. The Deployment Monitor
provides statistics about log collection and system resource usage.

NOTE: Log collection happens from the older date to the newer date. If no data is present, repeat the Tail
using a timeframe further in the past. It may take your LogRhythm appliance several hours to catch up to
the present after collection begins.

Additional Tasks
1. Activate and register the Microsoft Windows operating system on the appliance.

2. Ensure that you have the latest LogRhythm software, especially if there was a time lapse between the
receipt and the setup of the appliance.

3. Configure log collection from additional sources.

4. Run Microsoft Windows Update to confirm that you have the latest Microsoft updates installed on the
appliance.

LogRhythm Inc., 4780 Pearl East Circle, Boulder, CO 80301

www.logrhythm.com | (303) 413-8745 | support@logrhythm.com

© LogRhythm, Inc. All rights reserved

This document contains proprietary and confidential information of LogRhythm, Inc., which is protected by copyright and possible non-disclosure agreements. The
Software described in this Guide is furnished under the End User License Agreement or the applicable Terms and Conditions (“Agreement”) which governs the use
of the Software. This Software may be used or copied only in accordance with the Agreement. No part of this Guide may be reproduced or transmitted in any form
or by any means, electronic or mechanical, including photocopying and recording for any purpose other than what is permitted in the Agreement.

Disclaimer
The information contained in this document is subject to change without notice. LogRhythm, Inc. makes no warranty of any kind with respect to this information.
LogRhythm, Inc. specifically disclaims the implied warranty of merchantability and fitness for a particular purpose. LogRhythm, Inc. shall not be liable for any direct,
indirect, incidental, consequential, or other damages alleged in connection with the furnishing or use of this information.

Trademark
LogRhythm is a registered trademark of LogRhythm, Inc. All other company or product names mentioned may be trademarks, registered trademarks, or service
marks of their respective holders.

© LogRhythm, Inc. All rights reserved Page 18 of 18