TeskaLabs LogMan.io NFR Virtual machine
TeskaLabs LogMan.io is a SIEM (Security Information and Event Management) and advanced log management cyber security tool.
The NFR (Not-For-Resale) release of TeskaLabs LogMan.io is distributed as a virtual machine. The NFR VM is intended for evaluation, demonstrations, proof-of-concept deployments, and training purposes.
The following guide covers how to start and operate the TeskaLabs LogMan.io NFR Virtual Machine.
Installation
1. Download the NFR VM image
The VM image is encrypted, after the download, you have to decrypt it using following command. The password will be provided on request by support@teskalabs.com or your assigned TeskaLabs representative.
$ openssl enc -aes-256-cbc -d -pbkdf2 -in lmionfr2602-...enc -out lmionfr2602-....ova
Checksums:
$ shasum -a 256 lmionfr2602-virtualbox.ova
a5a0e2328ecbd10319beb4eb8481209b61ed49e1704ada7530260d0a0d1ffdb2 lmionfr2602-virtualbox.ova
$ shasum -a 256 lmionfr2602-vmware.ova
078683ab8559403ea6e26db6fbb21abf6c042f91c7decc0573d0f16f97e29f6b lmionfr2602-vmware.ova
2. Import the NFR VM image into your virtualization platform
Minimum specifications:
| Resource | Requirement |
|---|---|
| CPU | 2 cores |
| RAM | 48 GB |
| Disk | 300 GB (thin provisioning) |
| OS | Linux Ubuntu Server 22.04 LTS |
Tip
You may add more resources to improve performance, but do not allocate less than the values above.
3. Adjust the network configuration
Configure networking according to your needs. We recommend bridge mode so that the NFR VM is accessible from your local network and you can easily set up log shipping into TeskaLabs LogMan.io.
4. Start the NFR VM
After booting, the detected primary IP address will be printed on the VM's terminal.
Note this IP address — you will need it in the next step (referred to as x.x.x.x).
5. Update your system hosts file
Add the following line to your system hosts file, replacing x.x.x.x with the IP address from the previous step:
x.x.x.x lmionfr2602.logman.int
Hosts file location by OS:
- Windows —
C:\Windows\System32\drivers\etc\hosts - Linux / macOS —
/etc/hosts
6. Log in to TeskaLabs LogMan.io
Open a web browser and navigate to: https://lmionfr2602.logman.int
You will see a privacy warning about the TLS certificate — this is expected, as the VM uses a self-signed certificate. Accept the warning and proceed to the web application.
Tip
We highly recommend using a recent version of Google Chrome.
The username is nfruser, password is NFRuser123:) and the default tenant is nfr.
We advise you to change the password of the nfruser as soon as possible.
Initial setup
There is an integrated log collector running within the NFR VM, connected to nfr tenant.
This integrated collector is listening on ports 514, 1514, 6514, both TCP and UDP for a syslog logs.
You can also ship logs over TLS to these ports, there is an autodetection and internal Certificate Authority running within the NFR VM.
Product documentation
For a comprehensive documentation of how to use TeskaLabs LogMan.io, continue to TeskaLabs LogMan.io Documentation
Advanced usage
Accessing Operating system
The user name is tladmin and the password is tladmin.
You can login from the VM console.
The SSH is enabled/disabled.
Network configuration
The network is configured using Netplan on the OS level.
The configuration is stored at /etc/netplan/ directory.
The DHCP client is enabled on the primary virtual network interface by default.
Data lifecycle
NFR VM is configured for a very short log retency. It can be prolonged in the product settings.
Version of the TeskaLabs LogMan.io NFR VM: 26.02