Breadcrumbs

Install the Diagnostics Agent and Diagnostics Tool

System Requirements for Diagnostics Tool

  • Must be running LogRhythm SIEM version 7.8 or later.

  • (For customers on LogRhythm SIEM version 7.24 or earlier) Access to the LogRhythm EMDB and LogMart SQL Server databases requires running a SQL script to set up the appropriate account and app registration. For instructions on setting up a least-privilege, read-only SQL Server user for this purpose, see the Create a Least-Privilege SQL Server User for Querying LogRhythm Databases section below.

  • The LogRhythm Diagnostics Agent must be installed on each LogRhythm Windows component node (Platform Manager, Data Processors, AI Engines, and standalone Web Consoles). The Diagnostics Agent is required even for single-node LogRhythm XM deployments.

  • The LogRhythm Diagnostics Tool application should be installed on the PM/XM, where it will access SQL Server on TCP/1433 and InfluxDB on TCP/8076 locally. Communication to LogRhythm Diagnostics Agents happens through the API Gateway and Service Registry. If common services are already running on those hosts, no additional ports are required to be opened.

Installation Steps

Install and Configure the LogRhythm Diagnostics Agent

  1. Run the LogRhythm Diagnostics Agent installer, available on the LogRhythm Community, and included in the LogRhythm Installation Wizard.

  2. When the installer finishes, start the service. It will automatically register with Service Registry and requires no further configuration.

Install the LogRhythm Diagnostics Tool

The LogRhythm Diagnostics Tool should be installed on the primary Platform Manager or XM. The Diagnostics Tool requires TCP/1433 and TCP/8076 connectivity locally on the Platform Manager. The application installs to C:\Program Files\LogRhythm\LogRhythm Diagnostics.

  1. Run the LogRhythm Diagnostics Tool installer, included as part of the LogRhythm Installation Wizard.

  2. Open the Start menu.

  3. Click LogRhythm, and then click LogRhythm Diagnostics.

Create a Least-Privilege SQL Server User for Querying LogRhythm Databases

The LogRhythm Diagnostics Tool must create a least-privileged SQL user account (read-only) to use when querying the LogRhythm SQL Server databases. For customers on LogRhythm 7.25 or later, the LogRhythmDiagnostics account is created automatically.

Customers on older versions of LogRhythm SIEM (version 7.24 or earlier) who wish to use the updated Diagnostics Tool must reach out to Support or Professional Services for scripts to create the appropriate accounts.

Configuration or modification of the SQL account used by LogRhythm Diagnostics can be done through the LogRhythm Configuration Manager.