Fresh Installation¶

To install Logpoint:

1. Boot your system with the Logpoint v7.7.0 ISO. Multiple warning messages may appear during the first boot. They are not related to the ISO and can be ignored.

2. On Network connections, you can manually configure the network interfaces or proceed with the default configurations. By default, Logpoint uses the IPv4 protocol with Automatic (DHCP) configurations for the first network interface.

   

   Network connections screen¶

If you have multiple network interfaces, you must manually enable and configure each successive interface. Go to Configuring network interfaces for information on how to configure network interfaces.

3. Click Done.

4. The Logpoint ISO automatically partitions your storage devices for the installation using the following sizes:

   Partition	Mount Point	Size
   boot	/boot	1GB
   swap		8GB

   The remaining space is used for the following volumes:

   Volume	Mount Point	Size
   root	/	40GB
   application	/opt	25GB
   app_store	/opt/immune/app_store	20GB
   storage	/opt/immune/storage	All the remaining space

   

   Automatic partitioning of storage devices¶

You can manually customize the storage devices by selecting Reset. Go to Customizing storage partitions during installation for more information.

5. Select Done.

   Warning

   The installation process cleans the disk entirely. Make sure you backup your files before installing Logpoint.

6. Select Continue to start the installation process.

   

   Starting the installation process¶

7. Select Reboot Now. Logpoint reboots once more to complete the installation. If the installation process fails, you must erase all the data in the disk before reinstalling Logpoint.

8. After installation, you must either manually eject the boot disk or select to boot from the hard drive from the Boot Manager. If the process is not completed, the entire process will repeat.

9. Log in using the following credentials:

   Username: li-admin
   Password: changeme
   

10. Change the password immediately using the passwd command. The password should have a minimum length of 15 characters and should include a lowercase character, an uppercase character, a digit and a special character. Atleast 4 characters on your password should be different from the old password.

11. The README.txt file in the home directory of the li-admin user gives you an overview of the actions that can be carried out.

12. Use ifconfig command to view the IP address of the installed Logpoint.

13. Enter the IP address in your browser to access the Logpoint User Interface. Log in with the following credentials:

    Username: admin
    Password: changeme
    

14. Change the password immediately.

Standard Configuration and Advanced Configuration¶

During the first login, you can choose between a Standard Configuration, Custom Configuration, Collector, or Syslog Forwarder.

Select Configuration Type¶

Standard Configuration¶

Standard Configuration enables a quick start with preconfigured dashboards and repositories for access management, incident management, and perimeter security monitoring. Dashboards come with ready-to-use widgets for compliance, and the repositories are mapped to specific source types, such as firewalls and servers, which you can use when creating a log source.

To select standard configuration:

1. Log into Logpoint.

2. Select Standard Configuration.

3. Click Get started.

Select Pre-Configured Dashboards¶

4. Click Yes if you want pre-configured dashboards and No if you want to proceed without pre-configured dashboards.

   1. If you select No, only repos will be created.

   2. If you select Yes, select the repositories to be used for each widget in the pre-configured dashboard and click OK.

   

   Select Repositories¶

5. You will be redirected to the Log Sources page. Here, you can create log sources and store their logs in the repositories. To learn how to configure log sources, Log Sources.

Advanced Configuration¶

Use Advanced Configuration to apply Custom Configuration to Logpoint or configure a Collector or a Syslog Forwarder.

Custom Configuration¶

Custom Configuration has complete features without any preconfigured dashboards or repositories. You can configure it according to your specific needs and preferences.

To select custom configuration:

1. Log into Logpoint.

2. Click Advanced Configuration dropdown.

3. Select Custom Configuration.

4. Click Get started.

5. Click Confirm.

Select Custom Configuration¶

Collector¶

Collector collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured remote Logpoint. You can convert Logpoint to Logpoint Collector during login or configure later from Settings >> System Settings. For more information, go to Logpoint Collector.

To select collector:

1. Log into Logpoint.

2. Click Advanced Configuration dropdown.

3. Select Collector.

4. Click Get started.

5. Select Enable buffering to store the data in local persistence during a network outage.

6. Click Confirm.

Select Collector¶

Syslog Forwarder¶

Syslog Forwarder collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured Logpoints and a target storage. You can convert Logpoint to a syslog forwarder during login or configure later from Settings >> System Settings. For more information, go to Syslog Forwarder.

To select syslog forwarder:

1. Log into Logpoint.

2. Click Advanced Configuration dropdown.

3. Select Syslog Forwarder.

4. Click Get started.

5. Click Confirm.

Select Syslog Forwarder¶

Customizing storage partitions during installation¶

1. In Storage Configuration, select Reset.

Automatic partitioning of storage devices¶

2. Select Use As Boot Device for the device you want to boot Logpoint on.

Use As Boot Device¶

3. Select Add GPT Partition for an available device.

Adding GPT partition¶

4. Enter Size. The recommended size is at least 8GB for a new partition.

Selecting swap format¶

5. Select swap in Format and select Create.

6. Select Add GPT Partition again for the remaining size.

7. Select Leave unformatted in Format and select Create. This unformatted partition can be used to hold the logical volume group.

Selecting Leave unformatted format¶

8. Select Create Volume Group (LVM) to create a new volume group. You can create multiple volume groups. You can also create software RAID (md) disks.

Selecting Create LVM¶

9. Enter a name for the volume group and select Create.

Creating LVM¶

10. In the new volume group, select Create Logical Volume.

Selecting Create Logical Volume¶

11. Enter a Name, Size, Format, and Mount point for the new logical volume.

Creating Logical Volume¶

You must configure at least the following logical volumes before you can proceed with the installation:

Name	Mount point	Minimum size
boot	/boot	1GB
root	/	40GB
application	/opt	25GB
app_store	/opt/immune/app_store	20GB
storage	/opt/immune/storage	60GB

The installer automatically provides the names and mount points for the next default volume group every time you select Create Logical Volume.

12. Select Done after finalizing your storage configurations.