Quick start guide

In this guide, you will learn all the steps you need to take to start and configure Logmanager for the first time.

Logmanager is delivered as a rack server. For the installation you need to consider following details:

Hardware requirements for the mounting:

In case of cluster variant it is needed to count multiples of values in the table according to the number of connected nodes.

Connect to the server:

• 2x power cord (redundant power supply)
• UTP cable to the ethernet port 1
• UTP cable to the ethernet port iLO

Start the server now. Server is booted up about 5 minutes from the start.

Factory setting of the server is in the chapter: Factory settings.

• Connect your PC to the same network as the Logmanager server is connected.

• Set your IP address, for example 192.168.0.29 and mask 255.255.255.0.

• Now you can log in to the web administration on the address:

  https://<default_Logmanager_IP_address>/
  

default_Logmanager_IP_address is factory IP address of your Logmanager server.

• Change the IP address according to your requirements using the chapter IP addresses.
• Now re-set IP address of your PC so you can access the web administration of the Logmanager server again.
• Put a new IP address of your Logmanager server into your browser and log in again.

Default gateway is important for correct communication of the system in your network.

Now it is necessary to set a default gateway using chapter Routes.

Set a IP address of your default gateway which the Logmanager server has to use.

Setting the DNS servers is necessary for example to get additional info from your messages.

Proceed with the setting using chapter DNS.

Add the addresses of your DNS servers, which the Logmanager has to use.

Configuration of the DNS is applied after a click on the Apply button.

Time servers are important for correct functionality of the whole system. Every message stored to the Logmanager server has a timestamp. If the system has shifted time, timestamp will be shifted against the reality.

Set the NTP using the chapter NTP.

Configuration of the NTP is applied after a click on the Apply button.

To send email messages from the Logmanager server it is necessary to set the server for sending of the emails using the chapter SMTP.

To test the SMTP server, click on the test button.

If you own more Logmanager servers, which you want to connect to a cluster, use the chapter Cluster.

By building a cluster connection of nodes of the cluster is done and also automatic synchronization between the cluster participants happens. Setting has to be done on both nodes with identical name and password. IP address will be always the address of the second partner in the cluster.

Set user names, groups and their rights.

If you are using user accounts in domain, connect them using LDAP.

Use the chapter Users list.

Now you have to set all network devices to send their audit messages to the Logmanager.

Select data sources from following chapters:

• Log source devices configuration
• Beats agents
• Classifiers
• Forwarder

Devices which are sending audit messages thru syslog need to have IP addresses set in Logmanager server using the chapter IP prefix lists.

For most cases it is enough to have the IP address in the prefix list for correct setting of the device.

• Click on Logs ‣ Dashboards ‣ Log overview in the left menu.
• Filter messages stored in the database using table Device IP.
• Check the individual records in the table ALL EVENTS if they are accordingly parsed and saved.
• In case of incorrect classification of the device to the IP prefix list and subsequent change, this change is used only on new incoming messages.