Install a .NET 8 System Monitor on UNIX/Linux

This guide specifically outlines the process to install a .NET 8 System Monitor Agent on UNIX/Linux. .NET 8 System Monitor Agents for UNIX/Linux were made available with the release of LogRhythm SIEM 7.23.0.

When upgrading a Linux System Monitor Agent from .NET 4 to .NET 8, the position file data of compressed flat file log sources will not be migrated. The new Agent will treat these as new log sources.

The .NET 8 Linux agent is distributed as a .tar.gz package, supporting 64-bit x86-64 platforms for the following operating systems:

• Red Hat

• Debian

• Amazon Linux

• Ubuntu

• Rocky

Install a .NET 8 System Monitor Agent

To install a .NET 8 System Monitor Agent on a UNIX/Linux operating system:

1. Using a secure FTP client, such as WinSCP, log in to the system where you will be installing the Agent using root privileges.

2. Copy the install package to the /root/scsm-temp directory on the *NIX machine.

3. Using a terminal emulator, such as PuTTY, open an additional connection to the *NIX machine.

4. For a new installation, run the following lines of code:

mkdir -p scsm-temp

tar -xzf "scsm-7.xx.0.2xxx.x64.tar.gz" -C scsm-temp

cd scsm-temp

sudo chmod +x ./scripts/*

sudo ./scripts/install-script.sh 

The agent starts after running the final line of code, but stops due to the missing Mediator Host entry in scsm.ini. This is resolved in step 7.

To upgrade a .NET System Monitor Agent, execute the same first four lines of code above, but then run the following in place of the fifth line:

CODE

sudo ./scripts/upgrade-script.sh

6. Go to the Agent configuration folder: cd/opt/logrhythm/scsm/config

7. Update the scsm.ini file with the correct host IP: vi scsm.ini
   For more information, see Manually Update the System Monitor Configuration File.

8. To register the agent, refer to Agent Identification and Acceptance.

For more information about downloading Agent installers and their corresponding file names, consult the appropriate upgrade guide.

Start, Stop, and Restart the Agent

To start the Agent, run the following command:

sudo systemctl start scsm 

To stop the Agent, run the following command:

sudo systemctl stop scsm 

To restart the Agent, run the following command:

sudo systemctl restart scsm

Uninstall the Agent

To uninstall the .NET 8 Agent, execute the following script in the scripts folder:

sudo ./scripts/upgrade-script.sh