Breadcrumbs

LogRhythm Diagnostics Tool

Diagnostics Tool v3.5.0

The LogRhythm Diagnostics Tool is a standalone application that collects log and data files from LogRhythm components, runs Platform Manager (PM) database queries, and performs health, capacity, and performance analysis on a LogRhythm deployment. Analysis results and raw log data can be exported as HTML reports, XLSX workbooks, or ZIP archives for easy portability.

The LogRhythm Diagnostics Tool is made up of two components:

  • LogRhythm Diagnostics Tool: an Electron desktop application running on the Platform Manager (or XM). It hosts a local Go HTTP backend that queries SQL Server and InfluxDB directly on the PM, and communicates with remote Diagnostics Agents through the LogRhythm API Gateway and Service Registry.

  • LogRhythm Diagnostics Agent: a lightweight service installed on each LogRhythm Windows node (Platform Manager, Data Processors, AI Engines, standalone Web Consoles, etc.). Agents register automatically with Service Registry and require no manual port or credential configuration on LogRhythm 7.25 or later.

Background

For LogRhythm Customer Support technicians, determining the cause of problems coming in from the field requires manually collecting log files, performance counters, SQL table data and job histories, configuration files, state repositories, and more. The LogRhythm technician must request files and other data from each component in the deployment, a process that is time-consuming and could lead to human error.

The LogRhythm Diagnostics Tool allows customers and LogRhythm technicians to perform deep analysis of a LogRhythm deployment's operational characteristics by accessing, executing, and interpreting results with ease. The tool enables users to gather all pertinent logs, metrics, and query results from a LogRhythm deployment quickly and consistently, with no online components. All data collection is read-only, so there is negligible performance impact on the deployment itself.

Users can also determine whether the deployment is healthy and in specification with respect to platform and licensing sizing. If the deployment is not in a good state, the Diagnostics Tool provides recommendations and detailed analysis in the form of Sizing, Health, AIE Performance, MPE Performance, or Log Export reports.

Functionality

The LogRhythm Diagnostics Tool offers the following functionality. For a full list of log files and data points collected and consolidated by the Diagnostics Tool, see Log Files and Data Collected by the Diagnostic Tool.

  • Provides the current performance and capacity of the LogRhythm SIEM data pipeline, as measured against the Sustained Rate and Peak Rate definitions published by LogRhythm Solutions.

  • Empirically demonstrates where the deployment is operating against the prescribed rates, and illustrates how much capacity remains before the deployment would be considered oversubscribed.

  • Automates the analysis of a deployment's current data processing pipeline per the Solutions Sizing Guide, covering DP utilization, AIE engine power, DX cluster sizing, and N-1 redundancy, making it easy for field personnel and customers to understand the deployment's current capacity and performance.

  • Provides dedicated AIE Performance analysis, including per-rule and per-block metrics, rule change audit history, slow/costly/noisy rule rankings, stale block detection, and .dat spool time-series charts.

  • Provides dedicated MPE Performance analysis by fetching the lps_detail_snapshot.log from each Data Processor agent and ranking rules by volume-weighted CPU cost.

  • Installs and runs as a standalone Electron application on the Platform Manager. The Diagnostics Tool's backend queries SQL Server and InfluxDB locally on the PM and communicates with remote Diagnostics Agents through the existing LogRhythm API Gateway. No additional firewall ports are required on deployments running LogRhythm 7.25 or later.

  • Collects files and data in a passive, read-only manner. Does not make changes to the LogRhythm SIEM deployment during operation or have any write-access to the deployment

  • Exports analysis results as HTML reports and Excel workbooks. Exports raw component logs as per-node ZIP archives.

  • Gathers Hardware Health for customers running LogRhythm Appliances including the Overall Health and Disk Specific Health, and offers TSR Generation and Export functionality.

  • Runs on LogRhythm SIEM 7.8 or later. Customers on versions prior to 7.25 require a one-time SQL script to create the LogRhythmDiagnostics read-only database account. Refer to Install the Diagnostics Agent and Diagnostics Tool for details.

Release Notes

Features Overview

Version 3.5.0 is a complete rewrite of the LR Diagnostics Agent, LR Diagnostics UI, and LR Diagnostics backend, introducing the following major changes from version 2.4.0:

  • New lightweight Electron UI The UI communicates with the backend service and routes requests through API Gateway.

  • Service mesh integration to automatically discover remote Diagnostics Agent instances from Consul/Service Registry. No manual IP, port, or certificate configuration is required on LogRhythm 7.25+.

  • A Platform Sizing tab to provide a full LogMart analysis engine covering DP utilization, AIE engine power, DX cluster sizing, and N-1 redundancy recommendations. Exports to HTML and Excel.

  • An AIE Performance tab to fast-path AIE analysis without a full sizing run. Per-rule and per-block metrics, rule change audit, slow/costly/noisy rule rankings, stale block detection, and InfluxDB .dat spool charts. Exports to HTML.

  • An MPE Performance tab fetches the lps_detail_snapshot.log from each DP agent via service mesh and ranks MPE rules by volume-weighted CPU cost. Exports to HTML.

  • A Platform Health tab displays database stats, service status, disk utilization, and InfluxDB connectivity. Exports to HTML.

  • An Export Logs tab discovers all Diagnostics Agent instances via Service Registry and downloads logs and service status as per-node ZIP archives.

  • A Hardware Health tab provides high-level hardware heath and inventory data, along with the ability to gather Disk Status and generate/export TSR reports.

Known Issues

None as of LogRhythm SIEM 7.25.0.

Limitations

  • The Diagnostics Tool must be installed and run on the primary Platform Manager or XM, where it can access SQL Server on TCP/1433 and InfluxDB on TCP/8076 locally.

  • On LogRhythm deployments prior to version 7.25, a SQL script must be run to create the LogRhythmDiagnostics read-only database account before using the tool. See Install the Diagnostics Agent and Diagnostics Tool.

  • The Diagnostics Agent must be installed on every LogRhythm Windows component node in the deployment, including single-node XM deployments.

  • The MPE Performance tab requires that lps_detail_snapshot.log files exist on each Data Processor. These files are generated by the DP's Mediator service during normal operation.

  • Hardware Health is dependent on the hardware generation in use and should function natively on all LogRhythm Gen 4, 5, or 6 appliances. Some systems may require the installation of Dell OSMA for the Hardware Health to function