Skip to main content
Skip table of contents

Install LogRhythm NDR

Install Ubuntu 

  1. Download the Ubuntu Server 20.04.06 LTS (Focal Fossa) ISO file, available here.
  2. Write the ISO file to a USB stick.
  3. Boot the appliance with the USB stick inserted and install Ubuntu. For instructions, see Install Ubuntu Server.

    When entering the hostname of the server, exclude the . character from the name.

  4. Once Ubuntu is installed, you can configure the partition tables.

Configure the Partition Tables

The following steps are the same for all node types. The only difference is for the space available. 

This example is for a NS7500 5GB node.

Create the /opt  and /data Partitions


When the server is created, it will have a single drive dedicated for the partitions.

  1. Find the list of disks: 

    sudo lvmdiskscan |grep -v ram
    In this example, we had /dev/sda for the OS and /dev/sdb for the partitions.
  2. Create the physical volume:

    sudo pvcreate /dev/sdb
  3. Create the volume groups:

    sudo vgcreate vg-opt /dev/sdb
  4. Create the logical volume:
    Depending on the type of node, replace the values of the sizes.

    sudo lvcreate -L 16T -n lv-opt vg-opt
    sudo lvcreate -L 5T -n lv-data vg-opt
  5. View the volume groups:

    sudo lvdisplay
  6. List mapper names:

    sudo ls /dev/mapper/

    control  vg--opt-lv--data  vg--opt-lv--opt
  7. Create the filesystem:

    sudo mkfs.ext4 /dev/mapper/vg--opt-lv--opt
    sudo mkfs.ext4 /dev/mapper/vg--opt-lv--data
  8. Add the partitions to fstab:

    sudo echo "/dev/mapper/vg--opt-lv--opt /opt ext4 defaults 1 1 " >> /etc/fstab
    sudo echo "/dev/mapper/vg--opt-lv--data /data ext4 defaults 1 1 " >> /etc/fstab
  9. Make the data directory (opt will already exist):

    sudo mkdir /data
  10. Mount the filesystem:

    sudo mount -a

Configure the Network Interfaces

Install the Networking Service

  1. Install lfupdown (networking service):

    sudo apt-get install -y ifupdown

Set Up the Configuration File for the Networking Service


In this procedure, the following sample interfaces are configured:

Interface Name

Interface Role

ens1Management Interface
ens2Fabric Interface
ens4Capture Interface

To configure your interfaces, replace these sample names and roles with the names and roles of your interfaces.

  1. Configure your /etc/network/interfaces file:

    sudo vi /etc/network/interfaces
  2. Insert the following lines. Replace ens1, ens2, and ens4 with the names of your interfaces.

    source /etc/network/interfaces.d/*
    # The loopback network interface
    auto lo
    iface lo inet loopback
    # mistnet management interface
    auto ens1
    iface ens1 inet static 
        address <Management-ip>
        netmask <Management-SubNet-Mask>
        gateway <Management-Default-Gateway-IP>
    # mistnet fabric/interconnect interface
    auto ens2
    iface ens2 inet static
        address <fabric-ip-0>
        netmask <fabric-mask>
    # mistnet traffic interface-1
    auto ens4
    iface ens4 inet manual
    iface ens4 inet6 manual
        up ifconfig $IFACE -arp up
        up ip link set $IFACE promisc on
        down ip link set $IFACE promisc off
        down ifconfig $IFACE down
        post-up echo 1 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
  3. Switch the Management IP from Netplan to Networking. LogRhythm recommends using iDRAC for taking down the Management interface and bringing it back up by using the following ifdown/ifup command:

    sudo ifdown --force ens1 lo && ifup -a
  4. Enable the networking service:

    sudo systemctl unmask networking
    sudo systemctl enable networking
    sudo systemctl restart networking

Set Up the DNS Configuration

  1. Edit the file named /etc/systemd/resolved.conf and add the DNS server IPs with the following syntax (replace with your DNS server IPs):

  2. Restart the systemd-resolved service:

    sudo systemctl restart systemd-resolved

Disable and Uninstall the Netplan Appliances

  1. Stop, disable and mask the systemd.networkd service:

    sudo systemctl stop systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
    sudo systemctl disable systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
    sudo systemctl mask systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
  2. Remove the netplan service:

    sudo apt-get --assume-yes purge nplan

Reboot the Appliance

Reboot the appliance to verify the configuration is correct and permanent.

  1. Reboot the server:

    sudo systemctl --force reboot
  2. Once the server has rebooted, check the network interfaces to verify they are up and have saved the configuration changes:


Install Salt Minion

Before installing the salt minion service, check the time and date.

  1. Install salt minion service on the server:

    sudo apt install salt-minion
  2. Modify the configuration file to point to the salt master IP address obtained via the SRE team:

    sudo vi /etc/salt/minion
  3. Restart the salt minion service:

    sudo systemctl restart salt-minion
  4. Check the salt minion service status by using the following command and look for "running" and "salt master has cached the public key for this node":

    sudo systemctl status salt-minion
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.