Loghound installs with git clone and one script on a bare box. There is no Composer, no npm and no build step, and that is deliberate — but it does need five things from the machine and one thing from an account.
| What | Why |
|---|---|
| PHP 8.1 or newer | The whole application, daemons included, is PHP. No other runtime is involved anywhere. |
curl, json, pcre, sqlite3, mbstring | HTTP to Solr and to the enrichment endpoints; the wire format everywhere; the compiled log parser; local state; safe handling of hostile bytes. The installer checks each one by name and refuses clearly if any is missing. |
| systemd | One long-running daemon and two timers. On a box with no systemd the installer falls back to cron for the two timers and tells you plainly that the daemon then needs a supervisor of your own — cron’s floor is sixty seconds, and beating that floor is the whole point of the tailer. |
| Read access to the access logs | The installer creates a loghound system user and adds it to the adm group, which is what usually grants it. It then tests the access with a fresh process rather than by reading /etc/group, because supplementary groups are only read at process start. |
| A web server and a hostname | Apache or nginx, for the panel and for serving the beacon. The installer writes a dedicated PHP-FPM pool and a vhost for whichever you already run, and validates both before enabling them. |
Installing the extensions, if you need to:
# Debian / Ubuntu sudo apt-get install -y php-cli php-curl php-sqlite3 php-mbstring php-fpm # RHEL family sudo dnf install -y php-cli php-curl php-pdo php-mbstring php-fpm
And to confirm before you start:
php -v php -m | grep -E 'curl|json|pcre|sqlite3|mbstring'
Loghound keeps everything it learns in two Opensolr indexes it provisions itself, and it does not run without an account. It creates the indexes, uploads their configsets, reloads the cores, verifies them, and later trims them against the plan — none of which it can do on a Solr it does not administer, which is why there is no bring-your-own-Solr option.
Create an account, then take the account email and the API key from Account in the control panel; the installer asks for both. Retention scales with the plan rather than being cut off by it: Loghound trims its oldest data before the account reaches its disk limit, so a free plan keeps working and simply holds less history. What the plans hold.
A plan also limits how many indexes an account may hold, and Loghound needs two. That is checked before anything is created — see the plan index limit — and if you already run Loghound elsewhere you can join the pair you already have instead, which creates nothing at all.
- A TLS certificate for the panel hostname. The installer finds an existing one in the usual places and checks it four ways before deploying it — including that it chains to a trusted root, which is what stops a Let’s Encrypt staging certificate being installed and breaking every browser. Otherwise it offers certbot, self-signed, or plain HTTP.
- A richer
LogFormat. Plaincombinedworks out of the box. Logging a handful of extra headers makes detection materially better, and the LogFormat page says exactly what each one is worth. - The ability to add one script tag to your site. That is the beacon, and it is what turns inferred automation into proven automation and a guessed dwell time into a measured one.
trusted_proxies, if anything sits in front of your web server. Without it every visitor appears to come from the proxy and every address-based signal becomes worthless. With it set too broadly, any visitor can forge their own source address.
Worth knowing before you run anything as root on a production box:
- It never modifies an existing vhost, FPM pool, cron entry, systemd unit or any file it did not write.
- It
reloads your web server and PHP-FPM; it neverrestarts them, so other sites on the box keep their in-flight requests. - It opens every source log file read-only and never writes to, truncates, rotates, renames or deletes one. There is a test in the suite asserting a source file’s size is unchanged after a full read.
--dry-runprints every command it would run and every file it would write, and changes nothing. Run that first. The shell installer has the detail.