One binary installs everything.

Quickstart

1. Build the binary

   Go 1.25 or newer on any machine. The engine has no dependencies beyond the standard library and two golang.org/x packages, and it cross-compiles to a static Linux binary.

   git clone https://github.com/Wimanaconda/logline.git
   cd logline
   GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o logline ./cmd/logline
   # arm64 hosts: GOARCH=arm64

2. Run the installer on the host

   Copy the binary over and run it as root. It downloads the pinned ClickHouse and Vector releases, verifies them against the checksums compiled into the engine, creates the system users, writes the hardened systemd units, a local CA and the configuration, starts the services, creates the schema and the first admin, and runs doctor.

   scp logline host:
   ssh host
   sudo ./logline install
   # --yes skips the question; --name logs.example.com adds names to the certificate

3. Check it

   logline doctor runs every check the Health page shows and exits 1 on a failure. Then open the printed URL, sign in as admin with the one-time password and set a new one.

   logline doctor
   logline service status

4. Trust the certificate

   The UI serves a certificate signed by the CA at /etc/logline/tls/ca.crt. Install that file where the browsers are, or point LOGLINE_TLS_CERT and LOGLINE_TLS_KEY at a real certificate. ACME is not built in yet.

   # Ubuntu or Debian
   sudo cp ca.crt /usr/local/share/ca-certificates/logline.crt && sudo update-ca-certificates
   # macOS
   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.crt
   # Windows
   certutil -addstore -f Root ca.crt

Host requirements and sizing

Ubuntu 22.04 or 24.04, amd64 or arm64, systemd, root. Preflight stops before anything changes when a requirement is missing and says what to fix.

RAM

2 GiB minimum, 4 GiB practical. The profile below is chosen from it.

Disk

5 GiB free under /var/lib/logline. Mounting a bigger volume there before installing is the simplest way to size storage.

Ports

443 for the UI and API, 8088 for HEC, 514 udp and tcp for syslog, all movable with flags. ClickHouse listens on loopback only.

Clock

Time synchronization running; the installer checks.

The rest of the host is left to the OS page cache, Vector and the engine. Re-run the installer after changing RAM; --profile forces a profile. Every search also runs under time, memory, scan and result limits derived from the same figures (search limits).

What gets installed where

Four systemd units: logline-clickhouse, logline-vector, logline and logline-helper (the one root process, behind the Health page’s restart and logs buttons), plus logline-backup.timer for the nightly backup. Each runs as its own system user under ProtectSystem=strict with only its own directories writable.

/usr/local/bin/logline                 the engine and CLI
/opt/logline/bin/{clickhouse,vector}   pinned components, versions.json
/etc/logline/engine.env                engine settings, rewritten by every install
/etc/logline/engine.local.env          the operator's search-limit overrides, never rewritten
/etc/logline/install.json              what was installed, the choices to keep
/etc/logline/clickhouse/{config,users}.xml
/etc/logline/tls/{ca,server}.{crt,key}
/var/lib/logline/engine/               inputs, sourcetypes, users, sessions, tokens, dashboards
/var/lib/logline/engine/audit/         audit.jsonl
/var/lib/logline/engine/vector/        generated vector.yaml and secrets.json
/var/lib/logline/vector/               Vector disk buffers and file positions
/var/lib/logline/clickhouse/           ClickHouse data
/var/lib/logline/backups/              backup archives (root 0700)
/var/lib/logline/clickhouse-backups/   ClickHouse's backups disk
/var/log/logline/install.log           every install run
/var/cache/logline/                    downloaded release tarballs

Engine, helper and Vector logs go to the journal as JSON lines and, with ClickHouse’s logs, are searchable as index=_internal; the audit log as index=_audit (self-logging).

Day two

logline doctor                       # every check, exit 1 on a failure; --json for scripts
sudo logline backup                  # a backup now; the timer takes one nightly
logline service status               # the four units
logline service restart vector       # engine | vector | clickhouse | helper
logline service logs engine
sudo -u logline logline inputs add --type tcp --id app --port 5515 --index app --sourcetype json
sudo -u logline logline vector apply # re-render and validate; Vector reloads on its own
sudo logline users list              # accounts; the running engine picks up changes at once

Settings live in /etc/logline/engine.env, rewritten by every install; search-limit overrides go in engine.local.env and are applied by re-running the installer. Offline hosts: put the two release tarballs in /var/cache/logline first (logline install --artifacts lists them). logline install --root DIR --yes rehearses on any OS, writing every file and touching nothing else.

Removing

sudo logline uninstall          # stops and removes services, binaries and the download cache
sudo logline uninstall --purge  # also configuration (the CA, passwords), data, backups, logs and the users

Without --purge, running the installer again restores the install with the same CA, password and accounts. --purge deletes the backups with the rest of /var/lib/logline; copy them off the host first.

Not yet

• A separate logline upgrade with a pre-upgrade backup; today a re-run with a newer binary upgrades in place (take sudo logline backup first).
• The master key: HEC tokens and the ClickHouse password sit in root-readable files.
• TLS on the HEC and syslog listeners, ACME, a .deb package, adding disks.

The open issues are on the roadmap.