Deploy and Install

The installation process depends on where you deploy Logpoint.

There are five different ways to deploy On-prem SIEM:

• ISO file or image

• Open Virtualization Appliance (OVA) on a VMWare ESXi server v7.0.3 or later

• Amazon Machine Image (AMI) on Amazon Web Services

• Virtual Hard Disk (VHD) on Microsoft Azure

• Virtual Hard disk (VHD) on Microsoft Hyper-V Server 2016 or later

If it is not the latest version, we recommend you upgrade Logpoint to the latest version after you deploy it. To upgrade or install a patch, go to Upgrades and Patches. Before installing patch, check the product versions compatibility in the Compatibility Matrix.

Installation

After deployment, you must:

1. Verify access or connect to the deployment. How you verify access depends on the deployment type.

2. Setup the Logpoint server or instance. A Logpoint server or instance can be:

   1. Standard or Compliance mode — preconfigured dashboards and repositories for access management, incident management, and perimeter security monitoring. Dashboards come with ready-to-use widgets for compliance, and repositories are mapped to specific source types (firewalls, servers).

   2. Custom Configuration — you setup dashboards and repositories yourself.

   3. Collector — retrieves logs from sources, buffers them, normalizes logs into key-value pairs, applies static enrichment, and forwards to a Logpoint Storage Node.

   4. Syslog Forwarder — collects and normalizes logs (including from syslog collectors) and forwards them to Logpoint via TCP port 514.

3. Configure each relevant interface (DHCP or Manual/static). See network-specific sections per deployment type below.

4. Customize storage partitions during installation using automatic partitioning or customize partitions (create GPT partitions, LVM groups, logical volumes).

5. Upload your license.

ISO File or Image

For a fresh installation, download the latest Logpoint ISO file from Product Hub and download the latest Logpoint ISO.

The installation process completely cleans the disk, ensure that you back up your files before proceeding.

Prepare and boot

1. Prepare a bootable medium (USB drive or virtual drive for VMs) using the latest Logpoint ISO.

2. Boot your system using the bootable medium. Warning messages may appear during the first boot; these can be ignored.

Configure network connections

1. By default, Logpoint uses IPv4 protocol with Automatic (DHCP) configuration. You may manually set up network interfaces or proceed with default configurations.

2. For multiple-interface systems, enable and configure additional interfaces manually. Go to configuring network interfaces for more information.

Click Done.

Storage partitioning (automatic or manual)

To manually customize storage, click Reset during installation. Automatic partitioning default layout:

Partition	Mount Point	Size
boot	/boot	1GB
swap		8GB``

The remaining space is used for the following volumes:

Volume	Mount Point	Size
root	/	40GB
application	/opt	20GB
app_store	/opt/immune/app_store	20GB
storage	/opt/immune/storage	All remaining space

Start installation and reboot

1. Click Done and Continue to confirm disk cleanup and start installation.

2. When prompted, click Reboot Now. If installation fails, erase all disk data before reinstalling.

3. After installation, eject the boot disk or select hard drive as boot device in Boot Manager to avoid re-running the installer.

Initial login and password change

1. Log in on the console with:

Username: admin
Password: changeme

1. Immediately change the password using the passwd command. Password requirements:

• Minimum 15 characters.

• Include a lowercase letter, an uppercase letter, a digit, and a special character.

• At least four characters must differ from the old password.

1. Use ifconfig command to view the IP address. Enter the IP in your browser to access the Logpoint UI.

2. UI login (first time):

Username: admin
Password: changeme

1. Change password and click Save.

Open Virtualization Appliance (OVA)

The Logpoint open virtualization appliance (OVA) allows you to launch a Logpoint virtual machine in the VMWare ESXi server v7.0.3 or later.

With the Logpoint OVA, you can use:

• Virtualization to transform data centers into simplified cloud computing infrastructures and use flexible and reliable IT services. VMware vSphere virtualizes and aggregates the underlying physical hardware resources across multiple systems and provides pools of virtual resources to the data center.

• Managed Infrastructure to utilize large collections of infrastructures such as CPUs, storage, and networking as a seamless and dynamic operating environment without worrying about the complexity of a data center.

Deploy OVA

1. Go to Product Hub and download the .ova file.

2. Log into vSphere client.

3. Click the Host and Cluster icon.

4. Select the resource pool to install the OVA.

5. Right-click the resource pool and select Deploy OVF Template.

1. Select Local file.

2. Click Choose files and browse to the OVA file.

3. Click Next.

Name and compute

Assign a unique VM name and select a target location to avoid duplicate VM names, enforce the VM inherits appropriate permissions based on its folder or resource pool and place the VM in the correct location.

1. Enter a name for the virtual machine.

2. Select a target location for the virtual machine.

3. Click Next.

Select a Compute Resource

Select a compute resource to ensure the VM runs on a suitable host with suitable CPU, memory, and network resources.

1. Choose the destination resource for the virtual machine.

2. Click Next.

Template review and storage

1. Review details and verify minimum requirements:

CPU	Quad-core
Memory	8 GB
Disk	150 GB

1. Click Next.

2. Review details and verify minimum requirements:

3. Click Next.

4. Select virtual disk format:

   1. Eager Zeroed Thick: Allocates storage and clears all disk array data immediately.

   2. Thin Provision: Allocates storage and clears disk array data only on demand.

   3. Lazy Zeroed Thick: Allocates storage immediately but clears disk array data only on demand.

   
5. Select VM Storage Policy from the drop-down.

6. Select a datastore to deploy the virtual machine.

7. Click Next.

Network mapping and finish

1. In Destination Network, select the network for Logpoint.

2. Click Next.

Review Configuration

1. Review your configurations before creating a virtual machine.

2. Click Finish to create the virtual machine.

3. To make any changes, click Back.

Verify access (DHCP or Static)

You can connect to Logpoint in:

1. DHCP Mode to automatically configure configures the IP address, subnet mask, default gateway and DNS server information from a DHCP server.

2. Static Mode to configure your connection to Logpoint manually.

Connect Using DHCP mode

1. Select your virtual machine.

2. Go to Actions >> Power >> Power On. Use the green power arrow () to turn the machine on.

1. Note the IP addresses under Summary.

2. Enter the IP addresses as URLs on a web browser. For Example: https://10.45.3.64

3. Log in with:

Username: admin
Password: changeme

1. Change your password.

Connect Using Static mode

1. Select the required virtual machine.

2. Go to Actions >> Power >> Power On.

3. Click Launch Console.

1. Select Web Console. Click LAUNCH.

1. Log in with:

Username: admin
Password: changeme

1. Run command change-ip.

2. Enter HOSTNAME. Example: Logpoint

3. Enter the IP Address. Example: 10.45.3.64

4. Enter NETMASK. Example: 255.255.255.0

5. Enter GATEWAY. Example: 10.45.9.1

6. Enter PRIMARY DNS. Example: 10.0.3.2

7. Enter SECONDARY DNS. (Optional) Example: 8.8.8.8

8. Enter DOMAIN. Example: logpoint.local

SSH access (li-admin)

1. Go to Settings >> System >> System Settings.

2. Select SSH Key Pair for li-admin.

3. Enter a Pass Phrase.

4. Click Re-Generate Key Pair.

5. Copy the Private Key and save it in a file.

6. Use the chmod 400 <filename> command to make the key accessible for an SSH connection. Example: chmod 400 ~/.ssh/id_rsa

7. Use the ssh -i "<filename>" li-admin@<Logpoint_Server_IP> command.

   Example: ssh -i ~/.ssh/id_rsa li-admin@<LogpointServerIP>

8. Enter the Pass Phrase to establish the SSH connection from the remote device.

Amazon Machine Image (AMI)

Logpoint AMIs are used to deploy on AWS. It provides:

1. Scalable computing allows you to manage the computing configuration of the Logpoint instances and make real-time adjustments without investing in separate hardware.

2. Complete control over security lets you configure the ports, source IPs, and protocols that can access the Logpoint instances, ensuring a high level of security.

3. Flexible configuration lets you adjust the parameters such as storage, memory, CPU, and networking capacity without any hassle.

4. Virtual Private Cloud (VPC) allows you to create a logically isolated instance separated from the rest of the AWS cloud and connect it to the network only when required.

Obtaining Logpoint AMI

Contact the Logpoint Support team and provide your AWS Account Number and Deployment Region to receive Logpoint AMI. Logpoint can share AMIs within the following AWS regions: us-east-1, eu-west-1, ec-central-1, and ap-south-1.

1. Log in to the AWS management console.

2. Click the Support drop-down and select Support Center.

1. Note down the Account number at the top of the Support Center page.

Selecting the Deployment Region

1. Log in to the AWS management console.

2. In the top right drop-down, select the Region to deploy the instance.

1. Note down the selected Region.

Enabling EBS Encryption and launching from EBS-encrypted AMI To launch the Logpoint instances securely in the AWS environment, we recommend you enable EBS encryption and launch all instances from the EBS-encrypted AMI, including the root volume.

For enhanced security, we recommend you implement IMDSv2. To transition from IMDSv1 to IMDSv2, follow the AWS Documentation.

1. Log into the AWS management console.

2. Go to Services >> EC2 and select AMIs under Images.

1. Select Private Images from the drop-down.

2. Select the Logpoint AMI and click Copy AMI from the Actions drop-down.

3. Select the Destination Region.

4. Enter the Name and Description for the encrypted AMI.

5. Select Encryption and select the Master Key for encryption.

6. Once you are redirected to the AMIs page, select the Owned by me from the drop-down.

7. Select the copied AMI and click Launch.

Launching instance without enabling EBS Encryption

1. Log into the AWS management console.

2. Go to Services >> EC2 and select AMIs under Images.

3. Select Private Images from the drop-down.

4. Select the Logpoint AMI and click Launch.

Launching instance (basic recommended settings)

1. Choose an Instance Type from the list. The minimum configuration is t2.xlarge type with 4 CPUs and 16 GiB memory.

2. Click Next: Configure Instance Details.

Configuring Instance

1. Enter the Number of instances.

2. Deselect the Purchasing option as it is not relevant.

3. Select a Virtual Private Cloud (VPC) Network to host Logpoint AMI. You can create a new VPC or select from the available ones.

4. Select the Subnet for your instances from the selected VPC. You can use the existing subnet or create a new one.

5. Select Auto-assign Public IP if you want to make your instances accessible from the Internet.

6. Select Placement group to launch the instances in a placement group. The placement group determines how instances are placed on the underlying hardware. All the placement groups function under one of the following strategies:

   • Cluster — clusters the instances into a low-latency group in a single Availability Zone.

   • Spread — spreads the instances across the underlying hardware. You can either add the instance to an existing placement group by selecting Add to existing placement group or create a new placement group by selecting Add to a new placement group.

     • If you select Add to existing placement group, choose one of the available placement groups from the drop-down.

     • If you select Add to a new placement group, add a new placement group by specifying a Name and Placement group strategy.

7. Select Capacity Reservation.

8. Select a Domain join directory to join the Logpoint instance to a directory defined in the AWS Directory Service.

9. Specify the IAM role for the instances if required. Identity and Access Management (IAM) lets you specify permissions granted to each AWS resource.

10. Select Shutdown behavior for the instances. If you select Stop: the instances stop running, and Terminate: the instances are permanently deleted.

11. Select Stop - Hibernate behavior to enable hibernation in the instance.

12. Enable termination protection to receive a confirmation message before terminating the instances.

13. Select Monitoring to analyze instance metrics in detail using Amazon CloudWatch.

    By default, you have access to basic monitoring, allowing you to view metrics every five minutes. The CloudWatch detailed monitoring allows you to view the metrics in the one-minute interval.

14. Select a Tenancy infrastructure to run your instances.

15. Select Add an Elastic Inference accelerator to enable cost-efficient hardware acceleration.

16. Select Unlimited credit specification to allow the Logpoint instances to exceed the CPU utilization baseline whenever required.

17. Specify Amazon EFS File systems to mount to the Logpoint instance.

18. Leave the Network interfaces and Advanced Details settings as they are.

19. Click Next: Add Storage.

Adding Storage

1. Specify the storage device settings to launch the instance. Enter 150 GiB volume to install and run a Logpoint instance.

2. Click Next: Add Tags.

Adding Tags

1. Enter the tags to be applied to the instance. The tags help you distinguish the instances and volumes when required.

2. Click Next: Configure Security Group.

Configuring Security Groups

We recommend opening the required ports in the network Access Control List (ACL) and configure security groups to launch Logpoint instances securely.

1. In the Configure Security Group, select Create a new security group to set all the firewall rules that control the traffic for your Logpoint instances.

Port	Protocol	Service
514	TCP	Syslog Collector
6514	TCP	Syslog Collector SSL
6161	TCP/UDP	Snare Collector
6162	TCP/UDP	Snare Collector
6343	UDP	SFlow Collector
21	TCP	FTP
162	TCP	SNMP Trap Collector
443	TCP	Web Service
9001	UDP	EMC Collector
7996/7997/7998/7999	TCP	Logpoint Agent Collector

1. Click Review and Launch.

Obtaining a Key Pair After you click Launch, a key pair is required to establish an SSH connection with Logpoint. To obtain a key pair, you can either Choose an existing key pair or Create a new key pair from the drop-down menu.

If you choose to Create a new key pair,

1. Enter a Key pair name.

2. Click Download Key Pair.

1. Click Launch Instances.

If you Choose an existing key pair,

1. Select a key pair from the list of the available key pairs.

2. Read the confirmation message and agree with the terms.

1. Click Launch Instances.

Verify Access

1. Go to Services >> EC2 >> Instances.

2. Select the Logpoint instance from the list of available instances.

3. Go to the Networking tab and note the Public IPv4 address and the Instance ID. The public IP works as the URL to access your Logpoint from the user interface and to establish an SSH connection from remote devices.

4. Enter the public IP address in a web browser.

5. Log into the user interface using the following credentials.

   https://<Public_IP>
   Username: admin
   Password: <Instance ID>

6. We recommend you set the Public IP of the instance as the Server Alias after you log in. Go to Settings >> System >> System Settings >> General to set the Server Alias.

Connecting the Instance with the Provided key-value pair

To establish an SSH connection for the li-admin user:

1. Open the command prompt.

2. Locate the downloaded key pair file.

3. Use the chmod 400 <filename> command.

   Example: chmod 400 Logpoint.pem

4. Use the ssh -i "<filename>" li-admin@<Logpoint_Server_IP> to establish SSH connection from the remote device.

   Example: ssh -i “Logpoint.pem” [email protected]

VHD on Microsoft Azure

Using the Logpoint Azure VHD, you can:

1. Azure Security Center provides unified security management and advanced threat protection. You can apply security policies across your cloud workloads, limit your exposure to threats, and detect and respond to attacks.

2. Azure Monitor includes Log Analytics and Application Insights. It provides sophisticated tools for collecting and analyzing telemetry. It allows you to maximize the performance and availability of your cloud and on-premises resources and applications. It also helps you analyze the performance of your Azure applications and proactively identify issues affecting them.

3. Azure Cost Management provides a cost management solution that helps you monitor and control expenses and optimizes resource use. You can analyze costs, create and manage budgets, export data, and review and act on recommendations.

4. Azure Backup and Recovery protects the data of on-premises servers, virtual machines, and virtualized workloads. It also handles disaster recovery of these resources with on-site recovery.

Deploy using the Logpoint Azure VHD. High-level steps:

1. Get the Logpoint VHD (SAS URL) from Logpoint Sales.

2. Secure Azure infrastructure (use private subnets, managed disks, NSGs, encryption).

3. Deploy the Logpoint VHD: copy to storage account, create managed disk, create VM from managed disk.

Copy VHD to your Storage Account (using CLI)

az storage blob copy start --destination-blob <Name of the VHD>.vhd --destination-container <Destination Container> --account-name <Storage Account Name> --account-key <Storage Account Key> --source-uri <SAS URL of Logpoint Azure VHD>

Monitor copy:

az storage blob show -c <Container> -n <VHD Name> --account-name <Storage Account Name> --account-key <Storage Account Key>

Copy VHD to your Storage Account (using UI)

1. Log into the Microsoft Azure portal and go to Storage accounts.

2. Click the name of your account and click Access keys.

3. Copy the Storage account name and key1 or key2.

Create Managed Disk from VHD (Azure Portal)

1. Log into the Microsoft Azure portal and go to All services.

2. Search for Disks and select the service and click Create.

Basics

1. Select a Subscription method and a Resource Group.

2. Enter a Disk name.

3. Select the Region to deploy your managed disk.

4. Select an Availability zone within the selected region to ensure high-availability of the applications and protect the data and applications from accidental data center failures. The Availability zone may not be available for all locations.

5. Choose a Source type for the managed disk. To install the Logpoint VHD,

   • Select Storage blob as the source type.

   • Select a Source subscription method.

   • In the Source blob option, click Browse to provide the location of the destination container of the previously obtained Logpoint Azure VHD.

   • Select the Linux OS.

6. Select the disk Size in GiB. The disk size should be 150 GiB (equal to the size of the source).

1. Click Next : Encryption >.

Encryption

Select an Encryption type and click Next: Networking >>.

Networking

1. Select a Connectivity method.

2. Click Next : Advanced >.

Advanced

1. Enable shared disk to allow the managed disk to be attached to two or more virtual machines.

2. click Next : Tags >.

Tags

1. Enter the Tags for the resources. Tags are the name-value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups.

2. Click Next : Review + create >.

Review + create

The Review + create tab displays all the data entered in the previous pages. Click Previous before finalizing the configuration if necessary.

Click Create to create the managed disk.

Create VM from Managed Disk

1. Go to All Services >> Disks, select managed disk and create VM.

2. Select Subscription and Resource group (must match disk).

3. Enter a VM name.

4. Select the Availability options to manage the availability, recovery, and backup of the virtual machine. It protects your data and applications from data center outages and maintenance events.

5. The Image represents the base application for the virtual machine. In this case, it is the disk containing the Logpoint VHD.

6. Select a VM Size (minimum quad-core, 8 GB, 150 GB).

7. Select the required network ports accessible from the internet in the Public inbound ports option.

8. Click Next : Disks >.

9. Select an Encryption type.

10. Configure additional data disks for your virtual machine. You can create and attach a new disk or attach an existing disk.

11. Click Next: Networking >.

12. Select the Virtual network for your virtual machine. Virtual networks create logical isolation in Azure. Each virtual network has their IP addresses range, subnets, route tables, gateways, and security settings.

13. Select the Subnet range for your virtual network.

14. Select the Public IP to access your virtual machine from the internet. (None recommended)

15. Select Advanced in the NIC network security group.

16. Configure network security group with required ports.

17. Select Place this virtual machine behind an existing load balancing solution to provide an existing Azure load balancing solution to the VM.

18. Click Next : Management >.

19. In Monitoring,

    • Enable Boot diagnostics to capture serial console output and screenshots of the virtual machine. It helps to diagnose startup issues.

    • Enable OS guest diagnostics to get the metrics of the virtual machine every minute.

    • If you enable boot diagnostics with a custom storage account, select a Diagnostics storage account to store the metrics data.

20. In Identity, select System assigned managed identity to grant or receive permissions via Azure role-based access control.

21. In Auto-Shutdown, Enable auto-shutdown to shut down the virtual machines daily automatically.

22. Click Next : Advanced>.

23. Select the Extensions for the resources if needed.

24. In Custom data, enter a script, configuration file, or other data into the VM while it is being provisioned.

25. Enable User data to enter a script, configuration file, or other data.

26. Select a desired Host group or a Proximity placement group to group your VMs.

27. Click Next : Tags>.

28. Enter the Tags for the resources. Tags are the name-value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups.

29. Click Next : Review + create >.

30. The Review + create tab displays all the data entered in the previous pages. Click Previous before finalizing the configuration if necessary.

    Click Create to launch the virtual machine.

Recommended NSG ports (same as AMI list, plus 21/22 for data transfer in runtime)

Verify Access to Azure VHD

1. Go to All services >> Virtual machines.

2. Select the required Virtual machine.

3. In Overview, note down the Subscription ID. The Subscription ID is the password for the default user for accessing the Logpoint user interface.

4. Select Networking from the sidebar.

5. Note down the NIC Private IP. The IP address works as the URL to access your Logpoint user interface and to establish an SSH connection from remote devices. We recommend you to change the private IP address of the deployed Logpoint instance directly from the Azure Portal. If you change the IP address using the change-ip command, make sure it matches the NIC private IP address in the Azure portal.

1. Enter the NIC Private IP in a web browser.

2. Log into the user interface using the following credentials.

https://<NIC_Private_IP>
Username: admin
Password: <Subscription ID>

SSH access:

1. Go to Settings >> System >> System Settings.

2. Select SSH Key Pair for li-admin.

3. Enter a Pass Phrase.

4. Click Re-Generate Key Pair.

5. Copy the Private Key and save it in a file.

6. Use the chmod 400 <filename> command to make the key accessible for an SSH connection. Example: chmod 400 ~/.ssh/id_rsa

7. Use the ssh -i "<filename>" li-admin@<Logpoint_Server_IP> command.

   Example: ssh -i ~/.ssh/id_rsa li-admin@<LogpointServerIP>

8. Enter the Pass Phrase to establish the SSH connection from the remote device.

chmod 400 ~/.ssh/id_rsa
ssh -i ~/.ssh/id_rsa li-admin@<LogpointServerIP>

Virtual Hard Disk (VHD) on Microsoft Hyper-V Server 2016 or later

Using the Logpoint Hyper-V VHD, you can:

• Expandable private cloud environment: It provides flexible, on-demand IT services allowing you to make adjustments on resources as per change in requirements.

• Efficient hardware usage: It consolidates the servers dividing the workloads equally and uses powerful physical computers decreasing the power consumption and physical space.

• Improve business continuity: It minimizes the impact of both scheduled and unscheduled downtime of your workloads.

• Expandable virtual desktop infrastructure (VDI): It uses a centralized desktop strategy with VDI to increase business agility and data security, as well as simplify regulatory compliance and manage applications.

Requirements:

CPU	Quad-core
Memory	8 GB
Disk	150 GB

• Launch only one Logpoint instance from a single VHD. For multiple instances, create copies of the original VHD.

• Keep original VHD as backup; launch from copies.

• Hyper-V VHD is dynamically expanding; you can convert to fixed-size VHD via Edit Disk.

Deployment methods: Hyper-V Manager (GUI) or Windows PowerShell.

Deploy using Hyper-V Manager (wizard)

1. Open Hyper-V Manager → select Hyper-V server → Actions → New → Virtual Machine.

2. Wizard: set Name and Location (separate folder recommended) → Next.

3. Select Generation 1 → Next.

4. Assign Startup memory (minimum 8 GB), optionally Dynamic Memory → Next.

5. Network: select virtual switch → Next.

6. Connect virtual hard disk: Use an existing virtual hard disk → browse to Logpoint VHD → Next.

7. Review summary → Finish.

8. Start VM in Hyper-V Manager → Right-click VM → Start → Connect → Login.

Deploy using PowerShell (on Hyper-V server) Run as administrator:

New-VM -Name <VM_Name> -MemoryStartupBytes 8GB -BootDevice VHD -VHDPath "<the_LogpointVHD_path>" -Path "<destination_path_for_the_VM>" -Generation 1 -Switch <virtual_switch_name>

Initial credentials and access

• Console login (li-admin):

Username: li-admin
Password: changeme

• Change password:

passwd

• View IP:

ifconfig

or in PowerShell on Hyper-V server:

Get-VM -VMName <virtual_machine_name> | Get-VMNetworkAdapter | Select IPAddresses

• GUI login:

https://<IP>
Username: admin
Password: changeme

Configure the Logpoint Instance or Server

When you first log in, configure the Logpoint instance/server as one of:

• Standard or Compliance instance

• Advanced Configuration

  • Custom Configuration

  • Collector

  • Syslog Forwarder

Standard or Compliance

Standard Configuration enables a quick start with preconfigured dashboards and repositories for access management, incident management, and perimeter security monitoring. Dashboards come with ready-to-use widgets for compliance, and the repositories are mapped to specific source types, such as firewalls and servers, which you can use when creating a log source.

1. Log into Logpoint.

2. Select Standard Configuration and click Get started.

3. Choose Yes to use pre-configured dashboards (then select repos per widget) or No to proceed without dashboards (repos created).

4. You are redirected to Log Sources page to add log sources and map to repositories.

Advanced Configuration

Custom Configuration

Custom Configuration has complete features without any preconfigured dashboards or repositories. You can configure it according to your specific needs and preferences.

1. Log into Logpoint.

2. Click Advanced Configuration dropdown and select Custom Configuration.

3. Click Get started and Confirm.

4. Configure dashboards, repositories, and other settings manually.

Collector

Collector collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured remote Logpoint. It can enable buffering to persist locally during network outages. You can convert Logpoint to Logpoint Collector during login or configure later from Settings >> System Settings.

1. Log into Logpoint.

2. Click Advanced Configuration dropdown and select Collector.

3. Click Get started.

4. Select Enable buffering to store the data in local persistence during a network outage.

5. Click Confirm.

Syslog Forwarder

Syslog Forwarder collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured Logpoints and a target storage. You can convert Logpoint to a syslog forwarder during login or configure later from Settings >> System Settings.

1. Log into Logpoint.

2. Click Advanced Configuration dropdown.

3. Select Syslog Forwarder.

4. Click Get started and click Confirm.

Configuring Network Interfaces

1. Select the relevant interface.

1. Select Edit IPv4.

2. Choose Method:

   • Automatic (DHCP) — settings are auto-set.

   • Manual — enter Subnet, Address, Gateway, Name servers, Search domains.

1. Click Save.

Customizing Storage Partitions during installation

1. In Storage Configuration, select Reset.

1. Select Use As Boot Device for the device to install Logpoint.

1. Click Add GPT Partition for available device, specify Size (recommend at least 8GB).

2. Select swap in Format and select Create.

3. Add another GPT Partition for remaining storage.

4. Select Leave unformatted in Format and select Create. This unformatted partition can be used to hold the logical volume group.

5. Click Create Volume Group (LVM).

6. Enter a a Name, Size, Format, and Mount point for the new logical volume.

Required logical volumes before installation:

Name	Mount point	Minimum size
boot	/boot	1GB
root	/	40GB
application	/opt	20GB
app_store	/opt/immune/app_store	20GB
storage	/opt/immune/storage	60GB

The installer auto-provides the names and mount points for the default volume group every time you select Create Logical Volume.

1. Click Done after configuring logical volumes.