Install a System Monitor on Windows Core

The following guide contains instructions for installing System Monitor agents on the Windows Core operating system.

Windows Core Installation via Command Line

To install a System Monitor agent on the Windows Core operating system:

1. Download and extract the required System Monitor Agent package from the Community.

2. Copy the unzipped install file (LRSystemMonitor_64Core_xxx.exe) onto the Windows Core server using a method such as File Transfer.

3. Access the Windows Core Server and type powershell to start Windows Powershell.

4. Navigate to the .exe file transferred in step 2 and ensure it’s present on the Core server.

If upgrading a previous System Monitor Agent, check the current version by running the following command:

CODE

Get-Process -Name "SCSM" | Select-Object -Property Name,FileVersion

5. Run the .exe file to perform the installation using the following command, replacing “xxx” with the version number in the file name:

Start-Process -FilePath "C:\Users\Public\Downloads\LRSystemMonitor_64Core_xxx"

6. If necessary, when prompted, click Install on the wizard to install System Monitor dependencies (.NET and C++).

7. Follow the instructions in the LogRhythm System Monitor Service setup wizard.

   1. Pending Reboot. You may choose to ignore this warning and continue to install by clicking Next. If the install fails, reboot the system and try again.

   2. License Agreement. Accept the license agreement, if it appears, and then click Next.

   3. Destination Folder. Use the default installation path whenever possible. Click Next.

   4. You are now ready to install the program. Click Install.

   5. When the wizard is complete, select the Launch System Monitor Configuration Manager check box to start the System Monitor Configuration Manager.

   6. Click Finish.

If a restart is required at any point, this will be indicated in the setup wizard.

8. The General tab of the System Monitor Configuration Manager appears. Do the following:

   1. Replace CHANGE_THIS with the static IP address or fully qualified domain name of the appropriate Data Processor. By allowing a domain name, LogRhythm deployment connection settings using an internal host name can control IP address assignment through the DNS server.

   2. Enter the port number of the Data Processor to which the System Monitor will connect. The valid range is 1 to 65535, and the default is 443.

   3. Enter the static IP address (of the host running the System Monitor Agent) to use when connecting to the Data Processor. This must be an IP address, rather than a hostname.

   4. Enter the client source port number this System Monitor uses when connecting to the Data Processor. The typical range is 49152 to 65535 (default is 0, which uses the OS ephemeral range).

   5. Enter the Host Entity ID in the Host Entity ID field if this system should be assigned to a specific entity (default is 1, meaning no entity assignment).

   6. If you wish to change the storage locations of the Configuration files or State (cache) files, or you are deploying for High Availability (HA) deployment, you can modify the following options:

      • Configuration File Parent Directory

      • State File Parent Directory

   7. Click Apply.

If you need to reopen the System Monitor Configuration Manager for any reason, run the following command:

CODE

Start-Process -FilePath "C:\Program Files\LogRhythm\LogRhythm System Monitor\lrconfig.exe"  

9. Apply the changes in the Configuration Manager and then click OK.

10. Restart the System Monitor service using the following command:

Restart-Service -Name "SCSM"

11. Validate that the Agent version now matches the version of the installer:

Get-Process -Name "SCSM" | Select-Object -Property Name,FileVersion

12. Within the LogRhythm System Monitor Configuration Manager, click the Log File tab and then check the SCSM.log file at the location shown to ensure that there are no connection errors to the Data Processor.

13. Switch to the LogRhythm Client Console and refresh to ensure that the heartbeat is updating and the correct, new version is now reflected.

Windows Core System Monitor Upgrades

The same remote upgrade process outlined in the System Monitor Upgrade Guide applies.

Windows Core Supporting Commands

The following table displays helpful commands that you can use when navigating Windows Core during the process of installing a System Monitor.

Start-Process -FilePath "C:\Program Files\LogRhythm\LogRhythm System Monitor\lrconfig.exe"  

Get-Process -Name "SCSM" | Select-Object -Property Name,FileVersion  

Get-WmiObject Win32_Service | Where-Object { $_.Name -eq "SCSM" } | Select
Object -Property DisplayName, StartName  

Start-Process -FilePath "notepad.exe" -ArgumentList "C:\Program Files\LogRhythm\LogRhythm System Monitor\config\scsm.ini"  

Start-Process -FilePath "notepad.exe" -ArgumentList "C:\Program Files\LogRhythm\LogRhythm System Monitor\logs\scsm.log"  

Get-EventLog -LogName Application -After (Get-Date).AddMinutes(-15) | Sort-Object TimeGenerated