Update SIEM Configurations to Support GeoIP Changes

Starting with the January 2024 release of LogRhythm SIEM, the Knowledge Base (KB) will be expanded to contain more GeoIP data and improve IPv4 resolution accuracy. To support the larger KB file created by the added details, several configuration changes within the SIEM are required.

Settings to Validate and Change

In all versions of LogRhythm SIEM, changes are required in both the Client Console and the LogRhythm Job Manager configuration files. To manually update these configurations, follow the steps below.

This must be completed before January 2024, otherwise KB syncs will fail and you will not receive any updated content from LogRhythm.

Update the Client Console Configuration

1. From the host where client console is installed, navigate to the Client Console installation folder.

The default location is “C:\Program Files\LogRhythm\LogRhythm Console“.

2. Find “lrconsole.exe.config“ in the installation folder and open it in a text editor, for example, Notepad.

3. Find the keyword “maxReceivedMessageSize“ whose value will be “104857600“.

4. Change the value of the attribute to “1073741824“ ( maxReceivedMessageSize="1073741824").

5. Save the file and close it.

6. Close all open instances of LR Console and reopen it to allow the new configuration to take effect.

This is a local setting. The above steps should be completed for each host where the Client Console is installed.

Update the Job Manager Configuration

1. From the Platform Manager (PM) machine, where the LogRhythm Job Manager is installed, navigate to the Job Manager installation folder.

The default location is “C:\Program Files\LogRhythm\LogRhythm Job Manager“.

2. Find “lrjobmgr.exe.config“ in the installation folder and open it in a text editor, for example, Notepad.

3. Find the keyword “maxReceivedMessageSize“ whose value will be “104857600“.

4. Change value of the attribute to “1073741824“ ( maxReceivedMessageSize="1073741824").

5. Save the file and close it.

6. Restart the Job Manager service to allow the new configuration to take effect.