Console Configuration¶

From the UI¶

1. Log into Logpoint using a Logpoint Administrator account.

2. Generate an SSH key pair from System Settings. For details, go to SSH Key Pair for li-admin

3. Copy the generated key into a new file inside the ~/.ssh folder of your device.

4. Change the permission of the private key file.

   chmod 400 ~/.ssh/id_rsa
   

5. Use SSH to connect to your Logpoint.

   ssh -i ~/.ssh/id_rsa li-admin@<Logpoint Server IP>
   

From the CLI¶

1. Create an SSH pair in Logpoint.

   ssh-keygen -t rsa
   

2. Copy the public key to authorized keys.

   cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys
   

3. Move the newly created private key to a remote machine. You can use SCP to do this.

   scp ~/.ssh/id_rsa <remote-machine-username>@<remote_machine_ip>:
   

4. Change the permission of the private key file.

   chmod 400 ~/.ssh/id_rsa
   

5. Use SSH to connect to your Logpoint.

   ssh -i ~/.ssh/id_rsa li-admin@<Logpoint Server IP>
   

reboot¶

The reboot command restarts Logpoint.

poweroff¶

The poweroff command turns off Logpoint.

change-ip¶

The change-ip command changes the IP address of your Logpoint. You can change the primary interface for multiple interfaces using:

change-ip

change-hostname¶

The change-hostname command changes the hostname of your Logpoint.

change-hostname

change-docker-bip¶

The change-docker-bip command lets you check network availability of an IP range or update the IP range of the docker bridge in Logpoint. By default, docker bridge uses the IP address range 172.17.0.0/16. If there are devices in your network using the same IP range, there will be a network conflict.

To avoid network conflict, first use change-docker-bip command with --check to check the availability of IP/subnet. If there is a conflict, check another IP range until you find an available IP range. Use the command with --update to change the IP of docker bridge to an available IP range. Allowed prefix range for docker-bip is 1 - 30.

Syntax:

change-docker-bip --check/--update <bridge_ip/prefix>

Example:

To check network availability:

change-docker-bip --check 172.17.0.0/16

To update docker bridge IP:

change-docker-bip --update 172.17.0.1/16

change-date¶

The change-date command changes the time and date of your Logpoint. Provide the date-time in yyyy-mm-dd hh:mm:ss or yyyy/mm/dd hh:mm:ss format.

start-support¶

The start-support command enables remote connection for support. Use this command to permit the support team to access your Logpoint. It starts the support connection and keeps the support-port open for the specified amount of time. If the time is not specified, then the support-port is open for 1 hour only.

Syntax:

start-support <timeout in hours(optional)>

Example:

The syntax for start support connection with 1-hour timeout is:

start-support 2

The syntax for start support connection with no timeout is:

start-support infinite

stop-support¶

The stop-support command disables remote connection for support.

Syntax:

stop-support

repodir¶

The repodir command lets you add or remove a directory from the repository list.

Syntax:

repodir add <directory_name>

repodir rm <directory_name>

Examples:

repodir add /opt/immune/backup-storage

repodir rm /opt/immune/backup-storage

Make sure you create and mount a ZFS pool and a dataset before adding a new repository directory.

1. Create ZFS pool.

   zpool create -o ashift=12 -O atime=off -O canmount=off -O compression=lz4 -o autoexpand=on <pool name> <block device>
   

2. Create ZFS dataset.

   zfs create -o xattr=sa -o sync=disabled -o mountpoint=<mount point> <pool name>/<dataset name>
   

3. Mount.

   zfs mount <pool name>/<dataset name>
   

4. Add the new repository directory.

   repodir add <repo directory>
   

ethbonding (LACP)¶

The ethbonding command either adds a bond to multiple interfaces or removes a bond to get the original interfaces intact. Also, you can execute the ethbonding command to bind the virtual interfaces.

Syntax to add a bond:

ethbonding addbond eth0 eth1

Synatx to remove a bond and get the original interfaces intact:

ethbonding removebond eth0 eth1

uploadpatch¶

The uploadpatch command uploads the specified patch. It is recommended that you use the uploadpatch command in case of large sized patch file as this type of file might not be uploaded from GUI due to timeout limits.

Syntax:

uploadpatch <path_to_valid_Logpoint_pak_file>

Example:

uploadpatch LogpointPatch.pak

While uploading a patch using the uploadpatch command:

1. Upload the patch file in your /tmp directory.

2. Upload the patch to your Logpoint using the command:

   uploadpatch /tmp/Logpoint-7.0.0.pak.
   

3. After uploading the patch, delete the patch file from /tmp using the command:

   rm -rf /tmp/Logpoint-7.0.0.pak.
   

4. Log into the UI, go to Settings >> System Settings >> Updates and click the Install icon in Actions.

route¶

The route command shows and manipulates the IP routing table.

tcpdump¶

The tcpdump command analyzes the traffic on a network.

iptables¶

The iptables command adds or deletes firewall rules in Logpoint to support all the combination of arguments. These configurations are temporary, and last until new configurations are generated.

mount¶

The mount command attaches the filesystem found on a device to the big file tree.

umount¶

The umount command detaches or frees the loop device (if any) associated with a mount.

pvcreate¶

The pvcreate command initializes a Physical Volume for later use by the Logical Volume Manager (LVM). A physical volume can be either a disk partition, a whole disk, a meta device, or a loopback file.

Syntax:

pvcreate <physical volume>

Example:

pvcreate /dev/sdc

The above example initializes the partition /dev/sdc for later use by the LVM.

Extending Encrypted LVM Volumes in Logpoint¶

If LVM encryption is enabled during installation, a LUKS-encrypted crypt is created and logical volumes are built inside it. Use the cryptsetup and add-crypttab command to extend logical volumes with the vgextend and lvextend commands.

cryptsetup¶

The cryptsetup command allows you to manage encryption in storage media. Only LUKS encryption is supported.

Syntax:

cryptsetup <action> <action_args>

Available actions:

• luksFormat

• luksOpen

• luksChangeKey

• luksAddKey

• status

• resize

add-crypttab¶

The add-crypttab allows you to add an entry for an encrypted partition to the crypttab file to unlock it at boot time.

Syntax:

add-crypttab <device> <mapping>

The encrypted volume can be extended in two ways

vgextend¶

The vgextend command lets you add initialized physical volumes to an existing volume group to extend the group’s size. It also lets you re-add a physical volume missing due to a transient device failure, without re-initializing it.

Syntax:

vgextend <volume group> <physical volumes>

Example:

vgextend vg01 /dev/sdb /dev/sdc

The above example initializes the existing volume group vg01 with new physical volumes /dev/sdb/ and /dev/sdc.

lvextend¶

The lvextend command lets you extend the size of a logical volume. You can also extend the snapshots of logical volumes using the command.

Syntax:

lvextend <logical volume> <physical volume>

Example:

lvextend +54 /dev/vg01/lvol01 /dev/sdb3

The above example extends the size of /dev/vg01/lvol01 by 54MB on /dev/sdb3. However, /dev/sdb3 must be a member of the volume group vg01.

resize2fs¶

The resize2fs command resizes the file system. You can use it to enlarge or shrink an unmounted file system and expand the size of a mounted file system.

Syntax:

resize2fs <device> <size>

Example:

resize2fs /dev/sdb1

zfs¶

The zfs command configures ZFS datasets within a ZFS storage pool. A dataset is identified by a unique path within the ZFS namespace.

zpool¶

The zpool command configures ZFS storage pools. A storage pool is a collection of devices that provide physical storage and data replication for ZFS datasets. All datasets within a storage pool share the same space.

gdisk¶

The gdisk command creates and manipulates the Interactive GUID partition table (GPT). It automatically converts an old-style Master Boot Record (MBR) partition table or BSD disk label stored without an MBR carrier partition to the newer Globally Unique Identifier (GUID) Partition Table (GPT) format, or load a GUID partition table.

sgdisk¶

The sgdisk command creates and manipulates the Command-line GUID partition table (GPT) manipulator for Linux and Unix.

cleanup-opt¶

The cleanup-opt command lists files in the /opt directory according to size and lets you delete them. You can select multiple files from this list. Use the arrow keys to navigate the list. Press the Spacebar to select files and Enter to delete them. Deleted files are logged in the var/log/i-admin_cleanup-opt.log file.

cleanup-opt screen¶

grub-install¶

The grub-install command generates a GRUB core image using grub-mkimage and installs it in Logpoint. You must specify the device name on which you want to install GRUB.

Example:

grub-install INSTALL_DEVICE

mds-fs¶

The mds-fix command enables or disables microarchitectural data sampling (MDS).

Syntax to enable microarchitectural data sampling:

mds-fix enable

Syntax to disable microarchitectural data sampling:

mds-fix disable

lpfw-cli¶

Execute the lpfw-cli command to add and remove firewall ports. The command works with IP addresses, network addresses, and numeric ports but does not support domain names. It uses the iptables and ipsets subcommands to manipulate the firewall.

Syntax to view help texts for lpfw-cli commands:

lpfw-cli -h

You can use the lpfw-cli command with the iptables subcommand to:

• Add new firewall rules

• Remove firewall rules

• View firewall rules for all three chains (INPUT, OUTPUT, and FORWARD)

• View firewall rules for a particular chain (INPUT, OUTPUT, or FORWARD)

• Flush firewall rules

• Reload flushed firewall rules

• View firewall policies for all three chains (INPUT, OUTPUT, and FORWARD)

• View firewall policies for a particular chain (INPUT, OUTPUT, or FORWARD)

You can add new firewall rules to Logpoint using the lpfw-cli iptables add command.

Syntax:

lpfw-cli iptables add <direction>

The <direction> can be in, out, or fwd for INPUT, OUTPUT, or FORWARD respectively.

The list of options and their expected parameters are listed below:

You can remove firewall rules from Logpoint using the lpfw-cli iptables rm command. The options that can be used with this command are identical to the lpfw-cli iptables add command.

Syntax:

lpfw-cli iptables rm

You can view the firewall rules for all three chains (INPUT, OUTPUT, and FORWARD) using the lpfw-cli iptables show command.

Syntax:

lpfw-cli iptables show

You can view the firewall rules for a particular chain (INPUT, OUTPUT, or FORWARD) using the lpfw-cli iptables show <chain_type> command.

Syntax:

lpfw-cli iptables show <chain_type>

The <chain_type> can be input, output, or forward for INPUT, OUTPUT, or FORWARD respectively.

You can first set the default firewall policy to ACCEPT for all three chains (INPUT, OUTPUT, and FORWARD) and then flush the firewall rules using the lpfw-cli iptables flush command.

Syntax:

lpfw-cli iptables flush

You can reload flushed firewall rules using the lpfw-cli iptables reload command.

Syntax:

lpfw-cli iptables reload

You can view the firewall policies (ACCEPT or DROP) for all three chains (INPUT, OUTPUT, and FORWARD) using the lpfw-cli iptables policy command.

Syntax:

lpfw-cli iptables policy

You can view the firewall policies (ACCEPT or DROP) for a particular chain (INPUT, OUTPUT, or FORWARD) using the lpfw-cli iptables policy <chain_type> command.

Syntax:

lpfw-cli iptables policy <chain_type>

The <chain_type> can be input, output, or forward for INPUT, OUTPUT, or FORWARD respectively.

The ipset subcommand manages the IP sets. When Logpoint regenerates the firewall configuration it overwrites the changes made using this subcommand. You can use the lpfw-cli command with the ipset subcommand to:

• View all the IP sets

• View all the IP sets in verbose mode

• View information of a particular IP set

• Add a new IP to an IP set

• Remove an IP from an IP set

You can view all the IP sets using the lpfw-cli ipset show command.

Syntax:

lpfw-cli ipset show

You can view all the IP sets with their detailed information using the lpfw-cli ipset show -v command.

Syntax:

lpfw-cli ipset show -v

You can view an IP sets with its detailed information using the lpfw-cli ipset show <ipset_name> command.

Syntax:

lpfw-cli ipset show <ipset_name>

Here <ipset_name> is the name of the IP set whose detailed information you would like to receive.

You can add a new IP address to an IP set using the lpfw-cli ipset add <ipset_name> <ip_address> command.

Syntax:

lpfw-cli ipset add <ipset_name> <ip_address>

Here <ip_address> is the new IP address and <ipset_name> is the name of the IP set where you would like to add the new IP address.

You can remove an IP from an IP set using the lpfw-cli ipset rm <ipset_name> <ip_address> command.

Syntax:

lpfw-cli ipset rm <ipset_name> <ip_address>

Here <ip_address> is the IP address and <ipset_name> is the name of the IP set from where you would like to remove the IP address.

LP Diag Commands¶

LP Diag is a script that extracts various information from Logpoint. You can add a cron job (scheduled task) that runs periodically to fetch the diagnostic statistics to the machine.

The syntax to view help texts for lpdiag commands is:

lpdiag -h

The syntax to enable lpdiag cron job is:

lpdiag -e -H <interval_in_hours_between_1-23> -R <retention_period_in_seconds>

lpdiag -e -M <interval_in_minutes_between_1-59> -R <retention_period_in_seconds>

    where,
    H = Frequency in the hour(s) and value must be between 1-23
    M = Frequency in minute(s) and value must be between 1-59
    R = Retention period in second(s). The retention period is the time duration for which the diagnostic information
    is stored in your Logpoint.

Examples:

lpdiag -e -H 10 -R 21600
lpdiag -e -M 30 -R 21600

The syntax to disable lpdiag cron job is:

lpdiag -d

The syntax to check the status of a cron job is:

lpdiag -s

ifup¶

The ifup command brings a network interface up, making it available to transmit and receive data.

ifdown¶

The ifdown command takes a network interface down, placing it in a state where it cannot transmit or receive data.

change_identifier¶

The change_identifier command replaces the current identifier of a machine with the new identifier.

Syntax:

change_identifier <old_identifier> <new_identifier>

Example:

The syntax to change the identifier of your Logpoint with old identifier 20fdfa8c505c4bf99a44f025461cd974 and new identifier 20fdfa8c505c4bf99a44f025461cd975 is:

change_identifier 20fdfa8c505c4bf99a44f025461cd974 20fdfa8c505c4bf99a44f025461cd975

move-backup¶

The move-backup command moves the backup folder from the location /opt/immune to /opt/immune/new_backup if the backup_pool exists, else, it moves the backup folder to /opt/immune/storage.

Syntax:

move-backup

fdisk¶

The fdisk command displays information about the disk partitions, creates and deletes the disk partitions, and also changes the active partition.

Syntax:

fdisk [options] [device]

Here, options could be -b sectorsize, -l, -u, -t, -s partition, -v, -C cylinders, -H heads or -S sectors, and device refers to the name of the disk.

Example:

The syntax to specify the number of cylinders on the disk is:

fdisk [-C cylinders]

mkfs¶

The mkfs command creates a filesystem on a formatted storage device.

Syntax:

mkfs [options] [device]

Here, you must specify the device in the syntax, but adding the options is optional.

Example:

The syntax to create an ext2 filesystem on a formatted floppy disk which is inserted into the first floppy drive is:

mkfs /dev/fd0

rebackup¶

The rebackup command executes the backup process for the failed backups if the log backup is not successful after Logpoint automatically runs the script for the backup process.

Syntax:

rebackup

change-syslog-ssl-port¶

The change-syslog-ssl-port command changes the SSL port of Syslog Collector from 515 to 6514 or vice versa.

Syntax:

change-syslog-ssl-port [port_number]

loadkeys¶

The loadkeys command loads the kernel keymap for the console.

Syntax:

loadkeys [option] [filename]

Here, you must specify the option in the syntax, but adding the filename is optional.

multipath¶

The multipath command detects and coalesces multiple paths to devices.

Syntax:

multipath [option]

Here, the option could be [-v verbosity], [-b bindings_file], [-d], [-h|-l|-ll|-f|-t|-F|-B|-c|-q|-r|-i|-a|-u|-w|-W], [-p failover|multibus|group_by_serial|group_by_prio|group_by_node_name], [device].

multipathd¶

The multipathd command checks for failed paths. When this happens, it reconfigures the multipath map the path belongs to, so that the map regains its maximum performance and redundancy.

Syntax:

multipathd [option]

Here, the options could be [-v verbosity], [-d|-k], [-s], [-B], [-w].

fabric-auth¶

The fabric-auth command obtains and stores Ticket-Granting Ticket (TGT) which is used for authentication while connecting to the Fabric Storage.

Syntax:

fabric-auth

docker¶

The docker command enables the native docker commands such as start, ps, restart, stop, logs and images.

Syntax:

  docker <start|restart|stop|logs> <container_name/id>
docker <ps|images>

change-ueba-network¶

The change-ueba-network command changes the network of ueba0 interface used for UEBA.

Syntax:

change-ueba-network <CIDR_Address>

SNMPv3¶

Simple Network Management Protocol (SNMP) is used to monitor and manage information about network devices, including routers, switches, servers, and printers.

Logpoint supports SNMPv2 and SNMPv3:

• SNMPv2 is enabled from the Logpoint UI.

• SNMPv3 is only configured by the li-admin user using the snmpv3 commands.

You must manually configure SNMPv3 by creating users and setting their keys and passwords. You can manage SNMPv3 users using li-admin commands.

The add-snmpv3-user command allows you to add SNMP users in Logpoint.

Syntax:

add-snmpv3-user

Enter a unique username, password, and key.

The change-snmpv3-passwd command changes the password for SNMPv3 authentication.

Syntax:

change-snmpv3-passwd

• A list of existing users is displayed.

• Select a username.

• Enter and re-enter the new password.

The change-snmpv3-key command changes the encryption key of the SNMPv3 user.

Syntax:

change-snmpv3-key

• A list of existing users is displayed.

• Select a username.

• Enter and re-enter the new key.

The delete-snmpv3-user command allows you to add SNMP users in Logpoint.

Syntax:

delete-snmpv3-user

Enter the username of the user to delete.

toggle-acct¶

The toggle-acct command enables or disables the accounting service of Logpoint. The accounting service is disabled by default.

Syntax to enable the accounting service:

toggle-acct enable

Syntax to disable the accounting service:

toggle-acct disable

http-options¶

The http-options command enables or disables the HTTP Options method in your Logpoint. The method is disabled by default.

Syntax to enable the HTTP Options method:

http-options enable

Syntax to disable the HTTP Options method:

http-options disable

li-admin-pass-auth¶

The li-admin-pass-auth command enables or disables password authentication for the li-admin user. The default password is changeme.

Syntax to enable password authentication:

li-admin-pass-auth enable

Syntax to disable password authentication:

li-admin-pass-auth disable

enable-sshusers¶

You can use enable-sshusers to enable ssh access to all Logpoint users.

Syntax:

enable-sshusers

disable-sshusers¶

You can use disable-sshusers to disable ssh access to all Logpoint users. Once you disable ssh access, it can be enabled only from the console.

Syntax:

disable-sshusers

vlock¶

You can use vlock to lock one or more users’ virtual console sessions. It allows you to lock your own sessions while other users can still use the same Logpoint via other virtual consoles.

Syntax:

vlock option

The options can be:

netplan-apply¶

The netplan-apply command is used migrate Logpoint instances to Netplan for network configuration. The command uses YAML configuration files to specify the necessary network settings for Logpoint. The YAML files used for updating or migrating network configuration can be located in any directory within the home directory of the li-admin user.

Make sure the network parameters, their values and indentation in the YAML files are correct. Incorrect parameters can cause network disruptions or complete network outages.

After migrating a Logpoint to Netplan, you can also use the command to update the existing network configuration.

Syntax:

netplan-apply <YAML file>

Example:

netplan-apply network_config.yaml

To learn more, go to netplan migration.

shenandoah¶

The shenandoah command enables or disables the Shenandoah garbage collector. You can switch between the existing garbage collector and the Shenandoah garbage collector by enabling or disabling it.

Syntax to enable Shenandoah garbage collector:

shenandoah_manager enable

Syntax to disable Shenandoah garbage collector:

shenandoah_manager disable

check integrity¶

The check_integrity command is used to check the integrity of the logs stored in a repo. It checks the file’s sha512sum value to verify whether any files are changed. The final result will be stored in /home/li-admin/log_integrity_result.txt file.

Syntax:

check_integrity <repo_path> --filesystem <zfs or ext4> --worker_count <count>

• In repo_path, enter the full repo path where the logs are stored.

• In filesystem, specify the file system as zfs or ext4. This is optional.

• In work_count, specify parallel processing workers. The default is 4 workers.

Example:

check_integrity /opt/immune/storage/logs/_logpoint --filesystem zfs --worker_count 8

Restart Nginx¶

The restart_nginx command regenerates the configuration for nginx and restarts it.

Syntax:

restart_nginx