Skip to content

Installing EventLogCentral Server

This article covers the installation of the EventLogCentral server component. The server hosts the web-based administrative interface and manages configuration for all EventLogAgent clients in your environment. Complete this installation before deploying any EventLogAgent clients.

Step 1 — Download and prepare the installation package:

Download the following installation package:

lta-mp-eventlogcentral.zip

If the ZIP file was downloaded from the internet:

  1. Right-click the ZIP file
  2. Select Properties
  3. Click Unblock if present
  4. Click Apply

Extract the contents of the ZIP file to a temporary folder.

Step 2 — Run the installer:

Locate the installer in the extracted folder:

LTA_EventLogCentral.msi

Right-click the MSI file and select Install. Follow the installation wizard prompts to complete the installation.

By default, the application installs to:

C:Program FilesBlue Lance 2-0LTA_EventLogCentral

Step 3 — SSL certificate:

During installation, EventLogCentral automatically generates a self-signed TLS certificate:

File Location Purpose
ltaeventlog.pfx C:Program FilesBlue Lance 2-0certs Server TLS certificate used for HTTPS and agent communication
ltaeventlog.cer C:Program FilesBlue Lance 2-0certs Public certificate file — must be distributed to all EventLogAgent client machines when using self-signed certificates

Using a custom TLS certificate:

If your organization requires a custom CA-signed certificate instead of the auto-generated self-signed certificate:

  1. Replace the existing certificate file in the certs folder with your custom certificate
  2. Ensure the certificate:
    • Supports Server Authentication
    • Matches the server hostname or DNS name
  3. If the replacement certificate is password protected, update the following Windows environment variable with the certificate password:

LTAEVENTLOG_CERT_PASSWORD

  1. If the replacement certificate uses a different filename, update the appsettings.json file:
    • Locate the https:certificate setting
    • Update the value to reference the new certificate filename
  2. Restart the LT Auditor MP Event Log Server Service to apply the certificate changes

Step 4 — Verify the installation:

After installation completes:

  1. Open a browser on the server
  2. Navigate to:
https://<server-name>:52966
  1. Confirm the EventLogCentral login page appears
  2. Confirm the LT Auditor MP Event Log Server Service is running:

sc query “LT Auditor-MP Event Log Server Service”

The service should show as Running.

Step 5 — First time login:

On first access, log in using the default administrator credentials:

Field Value
Username admin
Password TempP@ssw0rd!2025

Change the default password immediately after first login. Refer to the Admin article for instructions on changing the administrator password.

Reviewing server logs:

If the application fails to start or clients cannot connect after installation, review the logs located in:

C:Program FilesBlue Lance 2-0LTA_EventLogCentrallogs

Check for:

  • Certificate loading failures
  • Port conflicts on 52965 or 52966
  • Database connectivity errors
  • TLS negotiation failures
  • Service startup issues

Password requirements:

When changing the default password or creating new user accounts, passwords must meet the following requirements:

Requirement Detail
Minimum length 10 characters
Uppercase letters At least one (A-Z)
Lowercase letters At least one (a-z)
Digits At least one (0-9)
Special characters At least one (!@#$%^&*)