Skip to main content
Skip table of contents

LogRhythm Default Passwords

LogRhythm comes configured with default passwords for a number of components that users may want to change to conform to best practices and security guidelines.

AI Engine User

The AI Engine user is called LogRhythmAIE. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab and then the Logins tab.
  3. Right-click the user LogRhythmAIE, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the AIEngine Configuration Manager.
  6. Enter the new password for the LogRhythmAIE user.
  7. Click the Test Connection button and verify that the connection is successful.
  8. To close the connection window, click OK.
  9. Click the Windows Service tab.
  10. Select the Start (or restart) the service when the configuration is saved check box.
  11. To save the settings, click OK.

AI Engine Drill Down Cache API User

The Case API user is called LogRhythmAIEDrillDownCache. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmAIEDrillDownCache, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the AIE Drill Down Cache API section.
  7. Enter the new password for the LogRhythmAIEDrillDownCache user.
  8. Click Save.

Alarming and Response Manager User

The Alarming and Response Manager user is called LogRhythmARM. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmARM, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Platform Manager Configuration Manager.
  6. Click the Alarming and Response Manager tab.
  7. Enter the new password for the LogRhythmARM user.
  8. Click the Test Connection button and verify that the connection is successful.
  9. To close the connection window, click OK.
  10. Click the Windows Service tab.
  11. Select the Start (or restart) the service when the configuration is saved check box.
  12. To save the settings, click OK.

Case API User

The Case API user is called LogRhythmCaseAPI. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmCaseAPI, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the Case API section.
  7. Enter the new password for the LogRhythmCaseAPI user.
  8. Click Save.

Case API Admin User

The Case API user is called LogRhythmCaseAPIAdmin. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmCaseAPIAdmin, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the Case API section.
  7. Enter the new password for the LogRhythmCaseAPIAdmin user.
  8. Click Save.

Case API Maintenance User

The Case API Maintenance user is called LogRhythmCaseAPIMaintenance. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmCaseAPIMaintenance, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the Case API Maintenance section.
  7. Enter the new password for the Case API Maintenance user.
  8. Click Save.

Data Indexer Carpenter User

The Data Indexer Carpenter user is called LogRhythmNGLM. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmNGLM, and select Properties.

  4. Enter the new password twice, and click OK to save the settings.

    The remaining steps are only required if using LogRhythm version 7.5 or below. In LogRhythm version 7.6 and above, this password is changed in Configuration Manager.

  5. Open a browser window and go to one of the following URLs:
    • Windows Data Indexer: http://localhost:9100/
    • Linux Data Indexer: https://<DX_IP_Address>
  6. Log in with user admin.
  7. Under Carpenter Config, click Change Password.
  8. Enter the new password for the LogRhythmNGLM user twice, and click Change Password.
  9. At the bottom of the window, click Submit to apply the changes.
    A confirmation warning appears.
  10. Click Continue, and then close the browser window.

Data Processor User

The Data Processor user is called LogRhythmLM. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmLM, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Data Processor Configuration Manager.
  6. Enter the new password for the LogRhythmLM user.
  7. Click the Test Connection button and verify that the connection is successful.
  8. To close the connection window, click OK.
  9. Click the Windows Service tab.
  10. Select the Start (or restart) the service when the configuration is saved check box.
  11. To save the settings, click OK.

Job Manager User

The Job Manager and Threat Intelligence Service user is called LogRhythmJobMgr. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmJobMgr, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Platform Manager Configuration Manager.
  6. Go to the Job Manager tab, and enter the new password for the LogRhythmJobMgr user.
  7. Click the Test Connection button and verify that the connection is successful.
  8. To close the connection window, click OK.
  9. Click the Windows Service tab.
  10. Select the Start (or restart) the service when the configuration is saved check box.

  11. To save the settings, click OK.

    The remaining steps are only required if the default TIS Configuration login has been changed.

  12. From the Start menu, open Threat Intelligence Service.
    The LogRhythm Threat Intelligence Service Configuration Window appears.
  13. Enter the new password for the LogRhythmJobMgr account, and click Next.
  14. If the service status is currently running, select Stop Service and then Start Service.

LogRhythm Global Administrator User

The default global administrator is called LogRhythmAdmin. To change the password of this user, do one of the following:

  • Via the LogRhythm Console:
    1. Open the LogRhythm Client Console and log in with the user LogRhythmAdmin.
    2. On the My LogRhythm menu, click Change Password.
      A message notifies you that after you change your password, the application will exit and you will have to log in using your new password.
    3. Click Yes to continue.
    4. Complete the following fields:
      1. Old Password. Type your current password.
      2. New Password. Type your new password.
      3. Verify New Password. Confirm your new password.
      LogRhythm supports passwords up to 255 characters long.
    5. Click OK to save your new password and close the Client Console.
    6. Start the Client Console again and log in using your new password.
  • Via SQL Management Studio:
    1. Log into the LogRhythm server, and open SQL Management Studio.
    2. Expand the Security tab, and then the Logins tab.
    3. Right-click the user LogRhythmAdmin, and select Properties.
    4. Enter the new password twice, and click OK to save the settings.
    5. Open the LogRhythm Client Console and log in with the user LogRhythmAdmin and the new password.

LogRhythm Global Analyst User

The default global analyst is called LogRhythmAnalyst. To change the password of this user, do one of the following:

  • Via the LogRhythm Console:
    1. Open the LogRhythm Client Console and log in with the user LogRhythmAnalyst.
    2. On the My LogRhythm menu, click Change Password.
      A message notifies you that after you change your password, the application will exit and you will have to log in using your new password.
    3. Click Yes to continue.
    4. Complete the following fields:
      1. Old Password. Type your current password.
      2. New Password. Type your new password.
      3. Verify New Password. Confirm your new password.
      LogRhythm supports passwords up to 255 characters long.
    5. Click OK to save your new password and close the Client Console.
    6. Start the Client Console again and log in using your new password.
  • Via SQL Management Studio:
    1. Log into the LogRhythm server, and open SQL Management Studio.
    2. Expand the Security tab, and then the Logins tab.
    3. Right-click the user LogRhythmAnalyst, and select Properties.
    4. Enter the new password twice, and click OK to save the settings.
    5. Open the LogRhythm Client Console and log in with the user LogRhythmAnalyst and the new password.

Notification Service User

The Case API user is called LogRhythmNotification. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmNotification, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the Notification Service section.
  7. Enter the new password for the LogRhythmNotification user.
  8. Click Save.

SQL Server System Administrator User

The default SQL system administrator is called sa. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user sa, and select Properties.
  4. Enter the new password twice.
  5. To save the new settings, click OK.

Web Console User

The Web Console user is called LogRhythmWebUI. To change the password of this user:

  1. Log into the LogRhythm server, and open SQL Management Studio.
  2. Expand the Security tab, and then the Logins tab.
  3. Right-click the user LogRhythmWebUI, and select Properties.
  4. Enter the new password twice, and click OK to save the settings.
  5. From the Start menu, open the Configuration Manager.
  6. Scroll to the Global section.
  7. Enter the new password for the LogRhythmWebUI user.
  8. Click Save.


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close