Chapter 11: Installation & Debugging
Site preparation, installation requirements, step-by-step deployment procedure, and common debugging scenarios
11.1 Installation Requirements
Proper installation of a log security system requires careful site preparation to ensure the hardware operates within its specified environmental parameters and that the physical security of the evidence vault is maintained. The images below illustrate the key installation requirements for a standard enterprise deployment, showing both the physical installation process and the required environmental conditions.
Power Requirements
- Dedicated 20A circuit per appliance pair
- UPS with minimum 4-hour runtime at full load
- Generator backup for extended outages
- PDU with per-outlet monitoring and remote switching
- Ground fault protection on all circuits
Environmental Requirements
- Temperature: 18–27°C (64–81°F) operating range
- Humidity: 40–60% RH, non-condensing
- Hot-aisle/cold-aisle separation required
- Minimum 600mm front clearance per rack
- Raised floor or overhead cable management
Physical Security Requirements
- Dedicated locked rack cabinet for vault hardware
- Biometric or badge access to server room
- CCTV coverage of all rack rows
- Tamper-evident seals on vault appliances
- Visitor log and escort policy enforced
Network Pre-Requisites
- VLANs pre-configured per network design
- Firewall rules approved and staged
- NTP servers reachable from all VLANs
- DNS resolution working for all hostnames
- Management VLAN isolated from production
11.2 Step-by-Step Installation Procedure
The following procedure describes the standard installation sequence for a log security system. Each step must be completed and verified before proceeding to the next. The procedure assumes that site preparation (power, cooling, network, physical security) has been completed and verified in advance.
Rack Mounting and Physical Installation
Install rack rail kits for each appliance. Mount appliances in the rack in the following order from bottom to top: UPS, patch panel, managed switch, ingest gateway, HSM, vault storage array, collector pair. Attach cable management arms. Apply tamper-evident seals to all vault hardware. Photograph the completed rack for documentation.
Cabling and Connectivity
Connect all power cables to the PDU. Connect all data network cables according to the approved cabling diagram — use blue cables for data network and red cables for management network. Connect fiber transceivers and LC-LC cables for 10G uplinks. Label all cable ends with the approved labeling scheme. Photograph the completed cabling for documentation.
Initial Power-On and BIOS Configuration
Power on each appliance in sequence, starting with the managed switch, then the ingest gateway, then the collectors, then the HSM, then the vault storage. Connect console cables and verify that each appliance boots successfully. Configure BIOS settings: enable Secure Boot, disable unused ports (USB, serial), set boot order to internal storage only. Enable IPMI/iDRAC and configure the management IP address.
Operating System and Software Installation
Install the approved operating system image on each appliance using the secure boot-verified installation media. Apply all security patches before connecting to the production network. Install the log security software components in the following order: HSM driver and PKCS#11 library, vault storage agent, ingest gateway service, collector agent. Verify software signatures before installation.
Network Configuration and Zone Assignment
Configure network interfaces with the approved IP addresses and VLAN assignments. Configure static routes for inter-zone communication. Verify connectivity to NTP servers and DNS resolvers. Configure firewall rules on the managed switch and dedicated firewall. Test connectivity between all components using the approved test plan.
HSM Initialization and Key Ceremony
Perform the HSM key ceremony with at least two authorized personnel present. Initialize the HSM with the approved security officer and user credentials. Generate the signing key pair (ECDSA P-384) and the encryption key (AES-256). Export the public key certificate for distribution to all components. Backup the HSM key material to the offline backup token using the approved procedure. Document the key ceremony with signed records.
Certificate Installation and mTLS Configuration
Install the CA root certificate on all components. Issue and install TLS certificates for each component from the organization PKI. Configure mTLS on all inter-component connections: collector-to-gateway, gateway-to-vault, management interfaces. Verify that all mTLS connections are established successfully using openssl s_client. Verify that certificate revocation checking (OCSP or CRL) is working correctly.
WORM Storage Configuration
Configure the vault storage with WORM/Object Lock in Compliance mode. Set the default retention period to the required value (e.g., 3 years for PCI DSS). Verify that the WORM lock is active by attempting to delete a test object and confirming the deletion is rejected. Configure the storage monitoring to alert on WORM policy violations. Document the WORM configuration with screenshots.
Integration and End-to-End Test
Configure log sources to forward events to the collector using the approved protocol (syslog TLS, Beats, or API). Verify that events flow end-to-end from source to vault storage. Verify that the hash chain is correctly formed. Configure SIEM integration and verify that events appear in the SIEM. Configure alerting and verify that test alerts are delivered. Proceed to acceptance testing as described in Chapter 10.
11.3 Common Debugging Scenarios
The following table documents the most common issues encountered during installation and initial operation, along with their root causes and recommended remediation steps.