The LogRhythm Job Manager is a Windows service that is a component of the Platform Manager. The following are the main responsibilities of the Job Manager:
Active Directory Synchronization
Administrators may opt to configure LogRhythm to synchronize user and group information from AD for the purposes of data contextualization and correlation tasks. AD Synchronization can be performed through a regularly scheduled synchronization process via the Job Manager or as a manual process using the AD Synchronization Tool. The Job Manager service performs scheduled AD Synchronization with these conditions:
-
Synchronization starts five minutes after the Job Manager service starts.
-
Synchronization occurs every hour if the Job Manager service is running.
-
The Job Manager attempts to synchronize three times after experiencing an error before waiting for the next scheduled synchronization.
-
The service the Job Manager runs under must have the permissions required to query AD to avoid permission related errors.
-
Only domains that have Include in Sync selected are synchronized.
Along with Active Directory Synchronization, Job Manager also performs Active Directory group-based authorization synchronization.
Knowledge Base Synchronization
The LogRhythm Knowledge Base is a package containing many of the system default settings for MPE Rules, Message Source Types, Platforms, Log Processing Policies, System AIE Rules, System Alarm Rules, Report Templates, and Compliance Packages. Knowledge Base Synchronization is scheduled in the KB Manager in the Client Console. If the Job Manager is running, the service will try to update and synchronize the Knowledge Base at scheduled time.
JSON Collector Policy Synchronization
Starting with LogRhythm SIEM version 7.26.0, JSON-based parsing policies are, by default, automatically delivered, imported, and distributed to .NET8 System Monitors, removing the need to manage policy files manually on disk. Users can, however, control whether an individual .NET8 Agent continues receiving policy updates using the Auto Policy Update setting on that .NET8 System Monitor (Windows/Linux). The policy import is performed by the Job Manager through the Policy Import Engine, which watches a dedicated import folder and brings new or updated policies into the EMDB database. The Job Manager service performs policy imports with these conditions:
-
The import runs when the Job Manager service starts, if a policy package is present in the import folder.
-
A newly placed policy package is picked up on the next scan cycle while the service is running.
-
Only new or changed policies are imported; policies already current in the database are skipped.
For more information, refer to Centralized Json Policy Management.
Automatic Report Generation
Reports are created and managed from Client Console. Reports are scheduled in form of Report Packages, which are collections of reports. When reports are scheduled from Client Console, the Job Manager executes that scheduled job by creating, exporting, notifying parties, and delivering the reports.
Automatic List Imports
The Job Manager List Import task runs continuously, polling at frequent intervals for list file changes. If a file with the correct name appears, the task imports the list. After a file has been successfully imported, it is deleted. If an error occurs during import, it is renamed with a suffix of .bad. The status of each list import attempt is written to the log file and event log.
The following default rules apply:
-
The default import directory is config\list_import (relative to the Job Manager install folder).
-
The default processing interval is 60 seconds.
-
The defaults cannot be changed.
Automatic List Expiration
The Job Manager makes database calls for list items that are configured to expire and marks them as expired at the appropriate time.
Heartbeat Monitoring
The Job Manager monitors the heartbeat of Mediators, System Monitor Agents, Log Sources, the AIE Communication Manager, the AIE Engine, and Network Montors. The Job Manager interacts with each component's state file and database information to get the component's heartbeat information.