This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

AxoRouter

1 - Install AxoRouter on Kubernetes

To install AxoRouter on a Kubernetes cluster, complete the following steps. For other platforms, see AxoRouter.

Prerequisites

Kubernetes version 1.29 and newer

Minimal resource requirements

  • CPU: at least 100m
  • Memory: 256MB
  • Storage: 8Gi

Network access

The hosts must be able to access the following domains related to the Axoflow Console:

  • When using Axoflow Console SaaS:

    • <your-tenant-id>.cloud.axoflow.io: HTTPS traffic on TCP port 443, needed to download the binaries for Axoflow software (like Axolet and AxoRouter).
    • kcp.<your-tenant-id>.cloud.axoflow.io: HTTPS (mutual TLS) traffic on TCP port 443 for management traffic.
    • telemetry.<your-tenant-id>.cloud.axoflow.io: HTTPS (mutual TLS) traffic on TCP port 443, where Axolet sends the metrics of the host.
    • us-docker.pkg.dev: HTTPS traffic on TCP port 443, for pulling container images (AxoRouter only).

  • When using an on-premise Axoflow Console:

    • The following domains should point to Axoflow Console IP address to access Axoflow from your desktop and AxoRouter hosts:

      • your-host.your-domain: The main domain of your Axoflow Console deployment.
      • authenticate.your-host.your-domain: A subdomain used for authentication.
      • idp.your-host.your-domain: A subdomain for the identity provider.

    • The Axoflow Console host must have the following Open Ports:

      • Port 80 (HTTP)
      • Port 443 (HTTPS)

Install AxoRouter

  1. Open the Axoflow Console.

  2. Select Provisioning.

  3. Select the Host type > AxoRouter > Kubernetes. The one-liner installation command is displayed.

  4. Open a terminal and set your Kubernetes context to the cluster where you want to install AxoRouter.

  5. Run the one-liner, and follow the on-screen instructions.

    Current kubernetes context: minikube
Server Version: v1.28.3
Installing to new namespace: axorouter
Do you want to install AxoRouter now? [Y]

  6. Register the host.

    1. Reload the Provisioning page. There should be a registration request for the new AxoRouter deployment. Select ✓.

      Provisioning AxoRouter - registration request

    2. Select Register to register the host. You can add a description and labels (in label:value format) to the host.

      Provisioning AxoRouter - registration details

    3. Select the Topology page. The new AxoRouter instance is displayed.

Create a flow

  1. If you haven’t already done so, create a new destination.
  2. Create a flow to connect the new AxoRouter to the destination.

    1. Select Flows.

    2. Select Create New Flow.

    3. Enter a name for the flow, for example, my-test-flow.

      Create a flow

    4. In the Router Selector field, enter an expression that matches the router(s) you want to apply the flow. To select a specific router, use a name selector, for example, name = my-axorouter-hostname.

    5. Select the Destination where you want to send your data. If you don’t have any destination configured, see Destinations.

      By default, you can select only external destinations. If you want to send data to another AxoRouter, enable the Show all destinations option, and select the connector of the AxoRouter where you want to send the data.

      AxoRouter as destination

    6. (Optional) To process the data transferred in the flow, select Add New Processing Step. For details, see Processing steps. For example:

      1. Add a Reduce step to automatically remove redundant and empty fields from your data.
      2. To select which messages are processed by the flow, add a Select Messages step, and enter a filter into the Query field. For example, to select only the messages received from Fortinet FortiGate firewalls, use the meta.vendor = fortinet + meta.product = fortigate query.
      3. Save the processing steps.

      Example processing steps

    7. Select Create.

    8. The new flow appears in the Flows list.

      The new flow

Send logs to AxoRouter

By default, AxoRouter accepts data on the following ports:

  • 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
  • 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
  • 6514 TCP for TLS-encrypted syslog traffic.
  • 4317 TCP for OpenTelemetry log data.

To receive data on other ports or other protocols, configure the source connectors of the AxoRouter host.

Make sure to enable the ports you’re using on the firewall of your host.

1.1 - Advanced installation options

When installing AxoRouter, you can set a number of advanced options if needed for your environment. Setting the advanced options in the Axoflow Console automatically updates the one-liner command that you can copy and run.

Advanced deployment options

Alternatively, before running the one-liner you can use one of the following methods:

  • Set the related environment variable for the option. For example:

    export AXOROUTER_USER=syslogng
export AXOROUTER_GROUP=syslogng

  • Set the related URL parameter for the option. For example:

    curl -fLsH 'X-AXO-TOKEN:random-generated' 'https://<your-tenant-id>.cloud.axoflow.io/setup.sh?type=AXOROUTER&platform=K8S&parameter=value' | sh

Proxy settings

Use the http_proxy=, https_proxy=, no_proxy= parameters to configure HTTP proxy settings for the installer. To configure the Axolet service to use the proxy settings, enable the AXOLET_AVOID_PROXY parameter as well. Lowercase variable names are preferred because they work universally.

Installation options

You can pass the following parameters to the installation script as environment variables, or as URL parameters.

AxoRouter image override
Default value: empty string
Environment variable IMAGE
URL parameter image

Description: Deploy the specified AxoRouter image.

Helm chart
Default value: oci://us-docker.pkg.dev/axoflow-registry-prod/axoflow/charts/axorouter-syslog
Environment variable HELM_CHART
URL parameter helm_chart

Description: The path or URL of the AxoRouter Helm chart.

Helm chart version
Default value: Current Axoflow version
Environment variable HELM_CHART_VERSION
URL parameter helm_chart_version

Description: Deploy the specified version of the Helm chart.

Helm extra arguments
Default value: empty string
Environment variable HELM_EXTRA_ARGS
URL parameter helm_extra_args

Description: Additional arguments passed to Helm during the installation.

Helm release name
Default value: axorouter
Environment variable HELM_RELEASE_NAME
URL parameter helm_release_name

Description: Name of the Helm release.

Image repository
Default value: us-docker.pkg.dev/axoflow-registry-prod/axoflow/axorouter
Environment variable IMAGE_REPO
URL parameter image_repo

Description: Deploy AxoRouter from a custom image repository.

Image version
Default value: Current Axoflow version
Environment variable IMAGE_VERSION
URL parameter image_version

Description: Deploy the specified AxoRouter version.

Namespace
Default value: axorouter
Environment variable NAMESPACE
URL parameter namespace

Description: The namespace where AxoRouter is installed.

Axolet parameters

API server host
Default value:
Environment variable
URL parameter api_server_host

Description: Override the host part of the API endpoint for the host.

Axolet executable path
Default value:
Environment variable AXOLET_EXECUTABLE
URL parameter axolet_executable

Description: Path to the Axolet executable.

Axolet image override
Default value: empty string
Environment variable AXOLET_IMAGE
URL parameter axolet_image

Description: Deploy the specified Axolet image.

Axolet image repository
Default value: us-docker.pkg.dev/axoflow-registry-prod/axoflow/axolet
Environment variable AXOLET_IMAGE_REPO
URL parameter axolet_image_repo

Description: Deploy Axolet from a custom image repository.

Axolet image version
Default value: Current Axoflow version
Environment variable AXOLET_IMAGE_VERSION
URL parameter axolet_image_version

Description: Deploy the specified Axolet version.

Initial GUID
Default value:
Environment variable
URL parameter initial_guid

Description: Set a static GUID.

2 - Install AxoRouter on Linux

AxoRouter is a key building block of Axoflow that collects, aggregates, transforms and routes all kinds of telemetry and security data automatically. AxoRouter for Linux includes a Podman container running AxoSyslog, Axolet, and other components.

To install AxoRouter on a Linux host, complete the following steps. For other platforms, see AxoRouter.

What the install script does

The AxoRouter installer will first install a software package which deploys a systemd service.

What the install script does

When you deploy AxoRouter, you run a command that installs the required software packages, configures them and sets up the connection with Axoflow.

The installer script installs the axorouter packages, then executes the configure-axorouter command with the right parameters. (If you’ve installed the packages in advance, the installer script only executes the configure-axorouter command.)

The configure-axorouter command is designed to be run as root (sudo), but you can configure axorouter to run as a non-root user. The configure-axorouter command is executed with a configuration snippet on its standard input which contains a token required for registering into the management platform.

The script performs the following main steps:

  • Generates a unique identifier (GUID).
  • Initiates a cryptographic handshake process to Axoflow.
  • Creates the initial configuration file for AxoRouter under /etc/axorouter/.
  • Installs a statically linked executable to /usr/local/bin/axorouter.
  • Creates the systemd service unit file /etc/systemd/system/axorouter.service, then enables and starts that service.
  • The service waits for an approval on Axoflow. Once you approve the host registration request, Axoflow issues a client certificate to AxoRouter.
  • AxoRouter starts to send telemetry data to Axoflow, and keeps sending them as long as the agent is registered and the certificate is valid.

Prerequisites

Minimal resource requirements

  • CPU: at least 100m
  • Memory: 256MB
  • Storage: 8Gi

Network access

The hosts must be able to access the following domains related to the Axoflow Console:

  • When using Axoflow Console SaaS:

    • <your-tenant-id>.cloud.axoflow.io: HTTPS traffic on TCP port 443, needed to download the binaries for Axoflow software (like Axolet and AxoRouter).
    • kcp.<your-tenant-id>.cloud.axoflow.io: HTTPS (mutual TLS) traffic on TCP port 443 for management traffic.
    • telemetry.<your-tenant-id>.cloud.axoflow.io: HTTPS (mutual TLS) traffic on TCP port 443, where Axolet sends the metrics of the host.
    • us-docker.pkg.dev: HTTPS traffic on TCP port 443, for pulling container images (AxoRouter only).

  • When using an on-premise Axoflow Console:

    • The following domains should point to Axoflow Console IP address to access Axoflow from your desktop and AxoRouter hosts:

      • your-host.your-domain: The main domain of your Axoflow Console deployment.
      • authenticate.your-host.your-domain: A subdomain used for authentication.
      • idp.your-host.your-domain: A subdomain for the identity provider.

    • The Axoflow Console host must have the following Open Ports:

      • Port 80 (HTTP)
      • Port 443 (HTTPS)

Install AxoRouter

  1. Select Provisioning > Select type and platform.

    Provisioning AxoRouter on Linux

  2. Select the type (AxoRouter) and platform (Linux). The one-liner installation command is displayed.

    Provisioning AxoRouter on Linux

    If needed, set the Advanced options (for example, proxy settings) to modify the installation parameters. Usually, you don’t have to use advanced options unless the Axoflow support team instructs you to do so.

  3. Open a terminal on the host where you want to install AxoRouter.

  4. Run the one-liner, then follow the on-screen instructions.

    Example output:

    Do you want to install AxoRouter now? [Y]
y
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
100  4142  100  4142    0     0  19723      0 --:--:-- --:--:-- --:--:-- 19818
Verifying packages...
Preparing packages...
axorouter-0.40.0-1.aarch64
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
100 31.6M  100 31.6M    0     0  2092k      0  0:00:15  0:00:15 --:--:-- 2009k
Verifying packages...
Preparing packages...
axolet-0.40.0-1.aarch64
Created symlink /etc/systemd/system/multi-user.target.wants/axolet.service → /usr/lib/systemd/system/axolet.service.
Now continue with onboarding the host on the Axoflow web UI.

  5. Register the host.

    1. Reload the Provisioning page. There should be a registration request for the new AxoRouter deployment. Select ✓.

      Provisioning AxoRouter - registration request

    2. Select Register to register the host. You can add a description and labels (in label:value format) to the host.

      Provisioning AxoRouter - registration details

    3. Select the Topology page. The new AxoRouter instance is displayed.

Create a flow

  1. If you haven’t already done so, create a new destination.
  2. Create a flow to connect the new AxoRouter to the destination.

    1. Select Flows.

    2. Select Create New Flow.

    3. Enter a name for the flow, for example, my-test-flow.

      Create a flow

    4. In the Router Selector field, enter an expression that matches the router(s) you want to apply the flow. To select a specific router, use a name selector, for example, name = my-axorouter-hostname.

    5. Select the Destination where you want to send your data. If you don’t have any destination configured, see Destinations.

      By default, you can select only external destinations. If you want to send data to another AxoRouter, enable the Show all destinations option, and select the connector of the AxoRouter where you want to send the data.

      AxoRouter as destination

    6. (Optional) To process the data transferred in the flow, select Add New Processing Step. For details, see Processing steps. For example:

      1. Add a Reduce step to automatically remove redundant and empty fields from your data.
      2. To select which messages are processed by the flow, add a Select Messages step, and enter a filter into the Query field. For example, to select only the messages received from Fortinet FortiGate firewalls, use the meta.vendor = fortinet + meta.product = fortigate query.
      3. Save the processing steps.

      Example processing steps

    7. Select Create.

    8. The new flow appears in the Flows list.

      The new flow

Send logs to AxoRouter

Configure your hosts to send data to AxoRouter.

  • For appliances that are specifically supported by Axoflow, see Sources.

  • For other appliances and generic Linux devices, see Generic tips.

  • For a quick test without an actual source, you can also do the following (requires nc to be installed on the AxoRouter host):

    1. Open the Axoflow Console, select Topology, then select the AxoRouter instance you’ve deployed.

    2. Select ⋮ > Tap log flow > Input log flow. Select Start.

    3. Open a terminal on your AxoRouter host.

    4. Run the following command to send 120 test messages (2 per second) in a loop to AxoRouter:

      for i in `seq 1 120`; do echo "<165> fortigate date=$(date -u +%Y-%m-%d) time=$(date -u +"%H:%M:%S%Z") devname=us-east-1-dc1-a-dmz-fw devid=FGT60D4614044725 logid=0100040704 type=event subtype=system level=notice vd=root logdesc=\"System performance statistics\" action=\"perf-stats\" cpu=2 mem=35 totalsession=61 disk=2 bandwidth=158/138 setuprate=2 disklograte=0 fazlograte=0 msg=\"Performance statistics: average CPU: 2, memory:  35, concurrent sessions:  61, setup-rate: 2\""; sleep 0.5; done | nc -v 127.0.0.1 514

      Alternatively, you can send logs in an endless loop:

      while true; do echo "<165> fortigate date=$(date -u +%Y-%m-%d) time=$(date -u +"%H:%M:%S%Z") devname=us-east-1-dc1-a-dmz-fw devid=FGT60D4614044725 logid=0100040704 type=event subtype=system level=notice vd=root logdesc=\"System performance statistics\" action=\"perf-stats\" cpu=2 mem=35 totalsession=61 disk=2 bandwidth=158/138 setuprate=2 disklograte=0 fazlograte=0 msg=\"Performance statistics: average CPU: 2, memory:  35, concurrent sessions:  61, setup-rate: 2\""; sleep 1; done | nc -v 127.0.0.1 514

Manage AxoRouter

This section describes how to start, stop and check the status of the AxoRouter service on Linux.

Start AxoRouter

To start AxoRouter, execute the following command. For example:

systemctl start axorouter

If the service starts successfully, no output will be displayed.

The following message indicates that AxoRouter can not start (see Check AxoRouter status):

Job for axorouter.service failed because the control process exited with error code. See `systemctl status axorouter.service` and `journalctl -xe` for details.

Stop AxoRouter

To stop AxoRouter

  1. Execute the following command.

    systemctl stop axorouter

  2. Check the status of the AxoRouter service (see Check AxoRouter status).

Restart AxoRouter

To restart AxoRouter, execute the following command.

systemctl restart axorouter

Reload the configuration without restarting AxoRouter

To reload the configuration file without restarting AxoRouter, execute the following command.

systemctl reload axorouter

Check the status of AxoRouter service

To check the status of AxoRouter service

  1. Execute the following command.

    systemctl --no-pager status axorouter

  2. Check the Active: field, which shows the status of the AxoRouter service. The following statuses are possible:

    • active (running) - axorouter service is up and running

    • inactive (dead) - axorouter service is stopped

2.1 - Advanced installation options

When installing AxoRouter, you can set a number of advanced options if needed for your environment. Setting the advanced options in the Axoflow Console automatically updates the one-liner command that you can copy and run.

Advanced deployment options

Alternatively, before running the one-liner you can use one of the following methods:

  • Set the related environment variable for the option. For example:

    export AXO_USER=syslogng
export AXO_GROUP=syslogng

  • Set the related URL parameter for the option. For example:

    curl -fLsH 'X-AXO-TOKEN:random-generated' 'https://<your-tenant-id>.cloud.axoflow.io/setup.sh?type=AXOROUTER&platform=LINUX&user=syslogng&group=syslogng' | sh

Proxy settings

Use theHTTP proxy, HTTPS proxy, No proxy parameters to configure HTTP proxy settings for the installer. To avoid using the proxy for the Axolet service, enable the Avoid proxy parameter as well. Lowercase variable names are preferred because they work universally.

Installation options

You can pass the following parameters to the installation script as environment variables, or as URL parameters.

AxoRouter capabilities
Default value: CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYSLOG CAP_BPF
Environment variable AXO_AXOROUTER_CAPS
URL parameter axorouter_caps

Description: Capabilities added to the AxoRouter container.

AxoRouter config mount path
Default value: /etc/axorouter/user-config
Environment variable AXO_AXOROUTER_CONFIG_MOUNT_INSIDE
URL parameter axorouter_config_mount_inside

Description: Mount path for custom user configuration.

AxoRouter image override
Default value: us-docker.pkg.dev/axoflow-registry-prod/axoflow/axorouter
Environment variable AXO_IMAGE
URL parameter image

Description: Deploy the specified AxoRouter image.

Extra container arguments
Default value: empty string
Environment variable AXO_PODMAN_ARGS
URL parameter extra_args

Description: Additional arguments passed to the AxoRouter container.

Image repository
Default value: us-docker.pkg.dev/axoflow-registry-prod/axoflow/axorouter
Environment variable AXO_IMAGE_REPO
URL parameter image_repo

Description: Deploy AxoRouter from a custom image repository.

Image version
Default value: Current Axoflow version
Environment variable AXO_IMAGE_VERSION
URL parameter image_version

Description: Deploy the specified AxoRouter version.

Package format
Default value: auto
Available values: auto, dep, rpm, tar, none
Environment variable AXO_INSTALL_PACKAGE
URL parameter install_package

Description: File format of the installer package.

Start router
Default value: true
Available values: true, false
Environment variable AXO_START_ROUTER
URL parameter start_router

Description: Start AxoRouter after installation.

Axolet parameters

API server host
Default value:
Environment variable
URL parameter api_server_host

Description: Override the host part of the API endpoint for the host.

Avoid proxy
Default value: false
Available values: true, false
Environment variable AXO_AVOID_PROXY
URL parameter avoid_proxy

Description: Do not use proxy for the Axolet process.

Axolet capabilities
Default value: CAP_SYS_PTRACE CAP_SYS_CHROOT
Environment variable AXO_CAPS
URL parameter caps

Description: Capabilities added to the Axolet service.

Configuration directory
Default value: /etc/axolet
Environment variable AXO_CONFIG_DIR
URL parameter config_dir

Description: The directory where the configuration files are stored.

HTTP proxy
Default value: empty string
Environment variable AXO_HTTP_PROXY
URL parameter http_proxy

Description: Use a proxy to access Axoflow Console from the host.

HTTPS proxy
Default value: empty string
Environment variable AXO_HTTPS_PROXY
URL parameter https_proxy

Description: Use a proxy to access Axoflow Console from the host.

No proxy
Default value: empty string
Environment variable AXO_NO_PROXY
URL parameter no_proxy

Description: Comma-separated list of hosts that shouldn’t use proxy to access Axoflow Console from the host.

Overwrite config
Default value: false
Available values: true, false
Environment variable AXO_CONFIG_OVERWRITE
URL parameter config_overwrite

Description: Overwrite the configuration when reinstalling the service.

Service group
Default value: root
Environment variable AXO_GROUP
URL parameter group

Description: The group running the Axolet service.

Service user
Default value: root
Environment variable AXO_USER
URL parameter user

Description: The user running the Axolet service.

Start service
Default value: true
Available values: true, false
Environment variable AXO_START
URL parameter start

Description: Start the Axolet service after installation.

WEC parameters

These parameters are related to the Windows Event Collector server that can be run on AxoRouter. For details, see Windows Event Collector (WEC).

WEC Image repository
Default value: us-docker.pkg.dev/axoflow-registry-prod/axoflow/axorouter-wec
Environment variable AXO_WEC_IMAGE_REPO
URL parameter wec_image_repo

Description: Deploy the Windows Event Collector server from a custom image repository.

WEC Image version
Default value: Current Axoflow version
Environment variable AXO_WEC_IMAGE_VERSION
URL parameter wec_image_version

Description: Deploy the specified Windows Event Collector server version.

2.2 - Run AxoRouter as non-root

To run AxoRouter as a non-root user, set the AXO_USER and AXO_GROUP environment variables to the user’s username and groupname on the host you want to deploy AxoRouter. For details, see Advanced installation options.

Operators must have access to the following commands:

  • /usr/bin/systemctl * axolet.service: Controls the axolet.service systemd unit. Usually * is start, stop, restart, enable, and status. Used by the operators for troubleshooting.

  • /usr/local/bin/configure-axolet: Creates initial axolet configuration and enables/starts the axolet service. Executed by the bootstrap script.

  • Command to install and upgrade the axolet package. Executed by the bootstrap script if the packages aren’t already installed.

    • On RPM-based Linux distributions: /usr/bin/rpm -Uv axo*.rpm
    • On DEB-based Linux distributions: /usr/bin/dpkg -i axo*.deb

  • /usr/bin/systemctl * axorouter.service: Controls the axorouter.service systemd unit. Usually * is start, stop, restart, enable, and status. Used by the operators for troubleshooting.

  • /usr/local/bin/configure-axorouter: Creates the initial axorouter configuration and enables/starts the axorouter service. Executed by the bootstrap script.

  • Command to install and upgrade the axorouter and the axolet package. Executed by the bootstrap script if the packages aren’t already installed.

    • On RPM-based Linux distributions: /usr/bin/rpm -Uv axo*.rpm
    • On DEB-based Linux distributions: /usr/bin/dpkg -i axo*.deb

You can permit the syslogng user to run these commands by running on of the following:

sudo tee /etc/sudoers.d/configure-axoflow <<A
syslogng ALL=(ALL) NOPASSWD: /usr/local/bin/configure-axolet
syslogng ALL=(ALL) NOPASSWD: /bin/systemctl * axolet.service
# for rpm installation:
syslogng ALL=(ALL) NOPASSWD: /usr/bin/rpm -Uv axo*.rpm
A

sudo tee /etc/sudoers.d/configure-axorouter <<A
syslogng ALL=(ALL) NOPASSWD: /usr/local/bin/configure-axorouter
syslogng ALL=(ALL) NOPASSWD: /bin/systemctl * axorouter.service
# for rpm installation:
syslogng ALL=(ALL) NOPASSWD: /usr/bin/rpm -Uv axo*.rpm
A

sudo tee /etc/sudoers.d/configure-axorouter <<A
syslogng ALL=(ALL) NOPASSWD: /usr/local/bin/configure-axorouter
syslogng ALL=(ALL) NOPASSWD: /bin/systemctl * axorouter.service
# for deb installation:
syslogng ALL=(ALL) NOPASSWD: /usr/bin/dpkg -i axo*.deb
A

sudo tee /etc/sudoers.d/configure-axorouter <<A
syslogng ALL=(ALL) NOPASSWD: /usr/local/bin/configure-axorouter
syslogng ALL=(ALL) NOPASSWD: /bin/systemctl * axorouter.service
# for deb installation:
syslogng ALL=(ALL) NOPASSWD: /usr/bin/rpm -Uv axo*.deb
A