Install the Alert Logic agent for Linux

Alert Logic provides an agent that gathers data that Alert Logic must collect for analysis, such as log messages and network traffic, as well as metadata and host identification information. You can assign a maximum of 500 agents per corresponding appliance in both Linux and Windows, regardless of appliance size. Refer to the Requirements for the Alert Logic agent page for the minimum system requirements to communicate with the physical appliance.

For more information, please contact Technical Support: US:(877) 484-8383, EU: +44 (0) 203 011 5533

Locate the Unique Registration Key

For Data Center deployments, you must locate the Unique Registration Key from the Configuration page. Copy your unique registration key. You will need to enter this key to install the agent.

Alert Logic uses the Unique Registration Key to assign the agent to your Alert Logic account.

If you have an active IAM or RBAC role (for AWS or Azure, respectively), and configured agents to automatically update, the agent you install automatically assigns itself to the local appliance and you need not enter the Unique Registration Key.

To access your Unique Registration Key:

  1. In the Alert Logic console, click Deployments, and then select an existing deployment.
  2. On the side navigation, click Installation Instructions, and then copy the Unique Registration Key.

Download the agent

To download the agent, select the link of the desired agent installers agent:

Agent Installer Processor Version Link More Information MD5
Debian 32-bit 2.9.3 al-agent_2.9.3_i386.deb 2018-11-16, 20:58, 2.91MB 6551f76b9c899e9068b852d4ff8f3a13
Debian 64-bit 2.9.3 al-agent_2.9.3_amd64.deb 2018-11-16 20:58, 3.47MB 8340098465b104de5b25abd6a19cefb3
RPM 32-bit 2.9.3 al-agent-2.9.3-1.i386.rpm 2018-11-16 20:58, 2.92MB 7f9be04dff4ced8703beea6e46175449
RPM 64-bit 2.9.3 al-agent-2.9.3-1.x86_64.rpm 2018-11-16 20:58, 3.47MB 43780ad47848f9af4804eee8eb050639

Install the agent

Linux users can select either Debian-based agent installers or RPM-based installers. Both installers are available in a 32-bit or 64-bit format.

If you have previously installed an older Linux version of an Alert Logic agent, you must uninstall that version before you install the current unified agent image.

For your convenience, the Alert Logic agent activates collection for Alert Logic customers. For more information, contact Technical Support: US:(877) 484-8383, EU: +44 (0) 203 011 5533.

Install the agent and not capture the image

To install the agent and not capture the image:

  1. Copy package to the target machine.
  2. If you run SELinux, you must first run the following command:
    semanage port -a -t syslogd_port_t -p tcp 1514

If the semanage command is not present in your system, you can install the policycoreutils-python package to obtain the semanage command. Alert Logic recommends that you consult with your system administrator to verify.

  1. Run one of the following commands, based on your distribution:
    • RPM: rpm -U al-agent-<version>*.rpm
    • Debian: dpkg -i al-agent-<version>*.deb
  1. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify it as a single point of egress for agents to use, run the following command:
    /etc/init.d/al-agent configure --host <LOGMANAGERAPPLIANCEIP>
  2. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>
    A TCP or HTTP proxy may be used in this configuration.
  3. Run the following command: /etc/init.d/al-agent provision --key <UNIQUEREGISTRATIONKEY>
  4. Run the following command: /etc/init.d/al-agent start

Do not run step 7 if you want to capture the image of a virtual machine.

  1. Do one of the following:
  1. Restart the syslog daemon.
  2. Verify that the agent has registered with the Alert Logic console. To do so, navigate to the deployment the agent is assigned to, click Collectors, and then search for the agent.

Agent registration can take several minutes.

Install the agent with image capture

To install the agent with image capture:

  1. Copy the package to the target machine.
  2. If you run SELinux, you must first run the following command:
    semanage port -a -t syslogd_port_t -p tcp 1514

If the semanage command is not present in your system, you can install the policycoreutils-python package to obtain the semanage command. Alert Logic recommends that you consult with your system administrator to verify.

  1. Run one of the following commands, based on your distribution:
    • RPM: rpm -U al-agent-<version>*.rpm
    • Debian: dpkg -i al-agent-<version>*.deb
  1. (Optional) If you have set up a NAT, virtual appliance, or physical appliance and you want to specify it as a single point of egress for agents to use, run the following command:
    /etc/init.d/al-agent configure --host <LOGMANAGERAPPLIANCEIP>
  2. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>

A TCP or HTTP proxy may be used in this configuration.

  1. Run the following command: /etc/init.d/al-agent configure --key <UNIQUEREGISTRATIONKEY>
  2. Do one of the following:
  1. Restart the syslog daemon.
  2. Shut down the target machine and save your operating system image.
  3. (Optional) Start an instance of the saved image and verify that the agent has registered with the Alert Logic console.
    If you need to edit your OS image at any point, you must ensure when saving that the Alert Logic agent is *not* registered. You can accomplish this by stopping the agent with:
    /etc/init.d/al-agent stop
    Then, if it is present, remove the files:
    /var/alertlogic/etc/host_crt.pem
    /var/alertlogic/etc/host_key.pem
    prior to shutting down and saving the resulting image.

Agent registration can take several minutes.

Related topics