Skip to main content
Version: Unreleased

Post-Installation Setup

Post-Installation Setup​

After completing the upgrade or initializing a fresh Monitor instance, follow these recommended steps to configure your deployment for production use.

  1. Configure TLS for GUI - Secure web access

  2. Create Notification Channels
    • Set up alerts

  3. Set Monitor Name - Identify your instance

  4. Configure Retention - Manage storage

  5. Tune Disk Space - Prevent disk full

Advanced Security - Optional hardening

Configure TLS for Monitor GUI​

Security Required

Securing the Monitor web interface with TLS is essential for production deployments. Without TLS, all credentials and data transmitted to/from the GUI are sent in plaintext.

Steps​

  1. Navigate to Monitor → Settings → Access tab
  2. Click Browse next to TLS certificate for GUI access
  3. Select your certificate file (PEM format: .pem or .crt)
  4. Click Browse next to TLS key for GUI access
  5. Select the matching private key (PEM format: .pem, .crt, or .key)
  6. Click Save to apply changes
Certificate Validation

The Monitor will automatically:

  • Validate both files are properly formatted
  • Verify the certificate and key match
  • Restart the web server with HTTPS enabled

Verification​

After saving, verify HTTPS is working:

curl -k https://<your-server>/

The -k flag temporarily accepts self-signed certificates. You should see Monitor's response.

Having trouble? See troubleshooting

See

TLS certificate for GUI access troubleshooting

for common errors and solutions.

Create Notification Channels​

Configure at least one notification channel so alerts, system-health notifications, and scheduled reports have somewhere to be received.

Then follow Creating a new channel for the full configuration walkthrough.

Set Monitor Name​

Assign a descriptive name to identify your Monitor instance in browser tabs, reports, and notifications.

  1. Navigate to Monitor → General tab
  2. Locate Monitor name field (default: "Monitor")
  3. Enter your desired name (max 30 characters)
  4. Click Save
Where the name appears
  • Browser tab title
  • Auto Trigger report headers
  • Channel notification footers

Configure Data and PCAP Retention​

Control how long to retain event data and uploaded files (PCAPs) to manage storage.

Configure Event Data Retention​

  1. Navigate to Monitor → Data Retention tab

  2. Event Data Retention:

    • Set Number of days to keep old events
    • Default: 30 days
    • Range: 0 to 730 days
    • Use 0 to disable automatic cleanup

  3. PCAP Retention:

    • Set Number of days to keep uploaded files
    • Default: 30 days
    • Range: 0 to 730 days
    • Use 0 to disable automatic cleanup

  4. Click Save

Storage Considerations
  • PCAP files consume significantly more space than event data
  • Consider shorter retention for PCAPs (e.g., 7-14 days) vs events (30-90 days)
  • For compliance requirements, archive critical PCAPs externally before they're deleted
Performance Note

Setting event retention above 160 days may impact Elasticsearch performance.

Tune Disk and Elasticsearch Space​

Prevent disk space issues that could cause Monitor to stop accepting data.

Configure Disk Management​

  1. Navigate to Monitor → System Health tab

  2. Data Partition Disk Management:

    SettingDescription
    Warning thresholdTriggers alert when free disk drops below this %
    Threshold for deleting old filesAuto-deletes when free disk drops below this % (use 0 to disable)

  3. Elasticsearch Disk Management:

    SettingDescription
    Warning thresholdTriggers alert when ES free disk drops below this %
    Threshold for deleting old filesAuto-deletes ES indices when free disk drops below this % (use 0 to disable)

  4. Select notification channels for health alerts

  5. Enable desired alerts:

    • Disk Space Alert
    • Connectivity Alert
    • Advanced Alerts Engine Connectivity (optional)

  6. Click Save

System Health Configuration

See System Health documentation for detailed information.

Secure Connection for Events​

Enable encrypted event ingestion to protect call data in transit.

  1. Navigate to Monitor → Ingestion tab

  2. Enable Encrypted Input:

    • Check Enable receiving events only via encrypted input
    • This blocks all unencrypted event connections

  3. Upload Event TLS Certificates:

    • Upload TLS certificate (PEM: .pem or .crt)
    • Upload TLS key (PEM, PKCS8 format: .pem, .key, or .crt)

  4. Configure Peer Verification (optional):

    • Select Peer certificate verification level
    • Choose verify peer certificate for mTLS
    • Upload CA certificate if verification enabled

  5. Configure Vector Ports:

    PortPurposeDefault
    Vector TCP portNon-TLS connections5044
    Vector TCP port (TLS)Secure TLS connections5045

  6. Click Save

Ingestion Settings

See Ingestion documentation for full configuration reference.

Elasticsearch Authentication​

Secure communication between Monitor and Elasticsearch using username/password authentication.

About ES_USERNAME and ES_PASSWORD​

Set the ES_USERNAME and ES_PASSWORD environment variables to enable authentication with Elasticsearch. These credentials allow Monitor to securely connect to your Elasticsearch cluster.

For a complete list of environment variables, see the Environment Variables Reference.

Enabling TLS Between Monitor and Elasticsearch​

Encrypt traffic between Monitor and Elasticsearch by configuring TLS. See the Elasticsearch TLS Setup Guide for detailed instructions on enabling TLS between Monitor and Elasticsearch.

Additional Recommendations​

  • Backups: Schedule automated Elasticsearch snapshots. Store backups off-site or in cold storage. Test restoration procedures regularly. See Elasticsearch Snapshots
  • Monitoring: Monitor Monitor's own health metrics. Set up alerts for High CPU/Memory usage, Slow Elasticsearch queries, Failed health checks
  • Log Aggregation: Centralize Monitor logs with ELK or similar. Configure log rotation to prevent disk issues. Set up log-based alerts for errors

Next Steps​

After completing setup:

  1. Test all notification channels deliver correctly
  2. Confirm TLS certificates are valid and trusted
  3. Document your configuration for team reference
  4. Set up regular maintenance schedule

Quick Reference​

ConfigurationNavigation Path
TLS for GUIMonitor → Access
Monitor NameMonitor → General
Data RetentionMonitor → Data Retention
Disk ManagementMonitor → System Health
Event SecurityMonitor → Ingestion