DP KVM Installer User Guide

OpenXDR KVM Installer complete installation flow

Overview

Use this page as the complete DP deployment runbook. It contains the DP-specific hardware baseline, KVM installation workflow, reboot/resume behavior, VM deployment, and the required DL/DA appliance configuration after the VMs are created. The documented baseline is Ubuntu Server 24.04 LTS. For a compact post-deployment-only view, see DP Cluster Initial Configuration.

1. System Architecture

Validated Dell PowerEdge R650 / R660 / R670 Configuration

Validated Dell PowerEdge R650, R660, and R670 Data Platform KVM architecture

Component	Example value
Validated KVM Hosts	Dell PowerEdge R650 / R660 / R670 — Ubuntu 24.04
DLm	`192.168.122.2`, 42 vCPU, 136 GB RAM, SSH 2222
DAm	`192.168.122.3`, 46 vCPU, 80 GB RAM, SSH 2223
libvirt NAT	`virbr0` / `192.168.122.1`
Host Access	1 GbE UTP, local-only `192.168.0.100`
Management & Data Link	1 GbE or 10 GbE
Cluster Link	1 GbE or 10 GbE, `cltr0`, SR-IOV
OS / VM Disk	1 × 1.92 TB — Ubuntu 24.04, DLm VM, DAm VM
Data Lake	6 × 3.84 TB — for DLm

Hardware at a Glance

The DP-Installer.sh workflow has been validated on Dell PowerEdge R650, R660, and R670 servers. The following values are the current DP defaults and documented deployment sizing example.

Item	Current DP value / guidance
DL VM	42 vCPU, 136 GB RAM, 500 GB system disk
DA VM	46 vCPU, 80 GB RAM, 500 GB system disk
OS / VM disk example	1 × 1.92 TB
Data Lake example	6 × 3.84 TB
Management	1 GbE or faster; 10 GbE recommended for larger deployments
Cluster link	10 GbE or faster recommended; SR-IOV-capable NIC for SR-IOV mode
Host access	Separate local-access NIC recommended for recovery
BIOS	CPU virtualization enabled; VT-d/IOMMU required for SR-IOV/direct device assignment

These are installer defaults and a validated deployment example, not a universal Stellar Cyber sizing rule. Confirm production sizing for the expected ingestion rate, retention, and workload.

Architecture Overview

Stellar Cyber OpenXDR Platform is deployed on a single physical server using KVM virtualization. The installer automatically creates and configures:

Ubuntu 24.04 KVM host
libvirt / qemu-kvm virtualization layer
DLm (Data Lake Master) virtual machine
DAm (Data Analyzer Master) virtual machine
Linux bridges and SR-IOV-based high-performance networking
dedicated storage volumes for system and data workloads

The installer automates:

host OS preparation and tuning
network topology creation
storage layout
virtual-machine lifecycle management
performance-related configuration such as CPU affinity and SR-IOV attachment

2. Pre-Installation Preparation

System Requirements

Before running the installer:

root privileges are required

The installer performs low-level system operations including:

network reconfiguration
kernel and system tuning
disk and filesystem configuration
virtual-machine creation and modification

Documented Operating System

This guide is based on Ubuntu Server 24.04 LTS.
The current DP-Installer.sh may retain compatibility paths for earlier DP/Ubuntu releases. For legacy deployment, verify the current source and target-release support separately.

Preparation Steps

Switch to a root shell.

sudo -i

Download the installer into the current directory.

curl -O https://raw.githubusercontent.com/xdr-labs/OpenXDR-KVM-Installer/main/DP-Installer.sh

Make it executable.

chmod +x DP-Installer.sh

Run the installer.

./DP-Installer.sh

Management NIC

The Management NIC is used for:

remote access to the KVM host
access to DLm and DAm web interfaces
external management and data traffic

For larger DP deployments, a 10GbE interface is recommended to provide sufficient throughput.

Cluster NIC

The Cluster NIC is dedicated to internal DP cluster communication. With SR-IOV, the NIC can be attached directly to the VM while bypassing the virtual-switch layer for maximum performance. Requirements:

SR-IOV-capable NIC
10GbE or faster
commonly Intel X710 or E810 series

Host Access NIC

The Host Access NIC is for local-only maintenance and troubleshooting. Characteristics:

default IP: 192.168.0.100
not reachable from remote networks
used for on-site access, emergency recovery, and KVM troubleshooting

This is especially useful when the Management NIC is 10GbE and cannot be connected directly to an engineer’s laptop.

NIC Preparation and Design Guidance

Before running the installer, physically connect the NICs that will be used. The installer identifies interfaces using link state, so connected cables help distinguish NIC roles during selection.

The installer provides an interactive menu interface implemented with Whiptail.

Spacebar or Down Arrow (↓): move through menu items
Enter: select
q or ESC: exit a help screen or return to the previous menu

State-Aware Execution

The installer is state-aware. Installation state is stored under:

/root/xdr-installer

completed steps are recorded
after a reboot or interruption, execution resumes from the next incomplete step

To remove all installation state and start again:

rm -rf /root/xdr-installer

Mandatory Reboot Steps

The installer automatically reboots after:

STEP 03 – Network conversion (netplan → ifupdown)
STEP 05 – Kernel and system-level tuning

These reboots are mandatory and must not be skipped. After reboot:

log in to the server again
relaunch the installer
select Menu 1

The installer resumes automatically.

1. Auto Execute All Steps

runs all steps beginning with the next incomplete step
resumes after reboot from the last completed step
recommended for:
- initial installation
- continuing after reboot

2. Select and Run Specific Step Only

runs one selected step independently
recommended for:
- DP VM redeployment
- network changes
- image updates
- storage reconfiguration

3. Configuration

Configures installer parameters:

DRY_RUN (default: 1)
DP_VERSION
MGT_NIC
CLTR0_NIC
DATA_SSD_LIST
CLUSTER_NIC_TYPE
ACPS credentials
- username
- password
- URL

4. Full Configuration Validation

Validates the complete system configuration. Checks include:

KVM
DP VMs
networking
SR-IOV
storage

Errors and warnings are shown with detailed logs.

5. Script Usage Guide

shows the built-in usage guide

6. View Log

displays the installer log

7. Exit

exits the installer

4. Installation Scenarios

The installer supports:

new installations
partially configured systems

Because it is state-aware, completed steps are recorded and execution can safely continue after reboot.

4.1 New Installation

This scenario applies when the installer is run immediately after Ubuntu installation.

Initial Configuration

From the main menu, select:

3) Configuration

Configure:

DRY_RUN
- default: 1 (simulation mode)
- change to 0 only when you are ready for real installation
DP Version
- specify the Data Platform version to deploy
ACPS Account / Password
- required to download the DP QCOW2 image and deployment files
ACPS URL
- keep the default in production
- change only in development or POC environments

After configuration, return to the main menu.

Auto Execute

Select:

1) Auto execute all steps

DP Installer Auto Execute All Steps screen

The installer runs:

STEP 01 → STEP 02 → STEP 03 → … → STEP 14

Mandatory Reboot Steps

STEP 03

converts network configuration from netplan to ifupdown
requires reboot to apply the change

STEP 05

applies kernel and system-level changes
requires reboot for system stability

After Reboot

log in again
relaunch the installer
select Menu 1

The installer resumes from the next incomplete step.

4.2 Run a Specific Step

This mode runs only one installation step without executing the entire workflow. It is intended for cases where:

one configuration needs to change
a previously failed step needs to be retried
one component must be redeployed or reconfigured

Only the selected step runs; other completed steps are not changed.

Common Use Cases

redeploy DLm / DAm VMs
redownload DP images or deployment scripts
reconfigure or reattach SR-IOV interfaces
reapply CPU affinity and performance tuning

How to Run a Specific Step

From the main menu:

2) Select and run specific step only

DP Installer specific-step selection screen

Step	Task
01	Detect and select hardware / NIC / disks
02	Install HWE kernel
03	Rename NICs / switch to ifupdown and configure networking
04	Install and configure KVM / libvirt
05	Tune kernel parameters / KSM / swap
06	Configure SR-IOV drivers + NTPsec
07	LVM storage (DL/DA root + data)
08	libvirt hooks and OOM recovery scripts
09	Download DP image and deployment scripts
10	Deploy DL-master VM
11	Deploy DA-master VM
12	SR-IOV / CPU Affinity / PCI Passthrough
13	Install DP Appliance CLI package
14	Configure NFS backup server (DP configuration backup only)

Execution flow:

select the step
confirm execution
the selected step runs and returns to the menu

This minimizes risk by avoiding unnecessary changes to unrelated components.

STEP 14 — NFS Backup Server

The final DP Installer step configures an NFS export for DP configuration backup. It is not a Data Lake data backup mechanism. The default configuration includes a /stellarcyber export path and allowed-client values based on the internal DL address. Review these values in Configuration before applying them to the target environment.

Important Notes

some steps depend on previous steps
- for example, CPU affinity requires the VM to exist
if a step fails because a prerequisite is missing, rerun the required previous step first
during troubleshooting, start with the smallest relevant step

5. Post-Installation Validation

After installation, select:

4) Full Configuration Validation

DP Installer Full Configuration Validation results

Validation Scope

KVM and libvirt service status
DLm / DAm VM status and autostart configuration
network configuration
- bridges
- SR-IOV interfaces
- routing tables
storage mount points and capacity

If WARN messages appear, use Menu 2 to rerun the relevant step.

6. Common Post-Installation Changes

Automatic Reboot Notice

STEP 03 always triggers a system reboot.

Change Scenarios

Change Management or Host Access NIC / IP

Rerun:

STEP 01 → STEP 03

Change Cluster NIC

Rerun:

STEP 01 → STEP 03 → STEP 12

Redeploy DLm / DAm VM

STEP 10 or STEP 11 → STEP 12

The existing VM is deleted. Existing ES Data Store DL storage may not be reusable.

Deploy a Different DLm / DAm Version

STEP 07 → STEP 09 → STEP 10 or STEP 11 → STEP 12

The existing VM is deleted and the ES data store cannot be reused.

7. After DLm / DAm Deployment

Default Network Configuration

DLm IP: 192.168.122.2/24
DAm IP: 192.168.122.3/24
Gateway: 192.168.122.1 (KVM internal bridge)

Web UI Access

Use the KVM host Management IP to access the Data Platform web UI. Example:

https://10.10.10.10

After deployment, update the Receiver IP for the environment. The default is the internal DAm IP.

CLI Access

Appliance CLI:

console dl-master
console da-master

SSH Access

DLm: port 2222
DAm: port 2223

8. Hardware and Software Requirements

Before real execution, confirm all DP-specific prerequisites on this page:

Ubuntu Server 24.04 LTS for the documented procedure
root access
CPU hardware virtualization enabled
VT-d / IOMMU enabled when using SR-IOV/direct device assignment
sufficient CPU and memory for the current DL/DA VM defaults shown above
sufficient OS/VM storage and dedicated Data Lake disks for the selected design
Management NIC, Cluster NIC, and recovery/Host Access connectivity
network access for package, image, and deployment artifact downloads

The Ubuntu 24.04 Installation Guide is optional background; all DP-specific requirements needed to choose hardware are summarized here.

9. BIOS and Platform Configuration

Verify that these features are configured according to platform requirements:

Intel Virtualization Technology
VT-d / IOMMU
SR-IOV capability on the cluster NIC

If you use SR-IOV for the DP Cluster Interface, verify both server BIOS and NIC device settings. A common Dell/Intel X710/E810 configuration requires Global/System SR-IOV enabled plus SR-IOV enabled at the NIC Device Level Virtualization Mode. Exact menus and requirements vary by server/NIC firmware, so follow vendor documentation together with the Ubuntu 24.04 Installation Guide.

10. Required DP Initial Configuration

The DP installation is not complete when the VMs are merely running. Complete the following DL/DA configuration before production use.

The KVM NAT management network is fixed per host: DL uses 192.168.122.2/24, DA uses 192.168.122.3/24, gateway is 192.168.122.1, and DNS is 8.8.8.8. Different physical KVM hosts can reuse these NAT addresses because each host has its own local libvirt NAT network.

10.1 DL Master

set interface management ip 192.168.122.2/24
set interface management gateway 192.168.122.1
set interface management dns 8.8.8.8
set hostname dl-master
reboot

After reconnecting:

set role DL-master
set cluster_name dl-master
set cluster_size 1
show interface all

Identify the actual cluster NIC from show interface all and continue:

set cluster_interface <cluster-interface>
set interface cluster ip 192.168.12.25/24
set cm 192.168.12.25
set mode MDS enable
set mode replica security
set mode shard_balance enable
set otp <YOUR-OTP>
reset

Add Data Lake storage:

show storage
add storage blk vdb

add storage blk formats the selected device. Confirm vdb before approving. Never store a real OTP in documentation or source control.

10.2 DL Worker

Worker 1 example:

set interface management ip 192.168.122.2/24
set interface management gateway 192.168.122.1
set interface management dns 8.8.8.8
set hostname dl-worker1
reboot

After reconnecting:

set role resource
show interface all
set cluster_interface <cluster-interface>
set interface cluster ip 192.168.12.26/24
set cm 192.168.12.25
reset
show storage
add storage blk vdb

Use a unique hostname and cluster IP for every additional worker, for example dl-worker2 / 192.168.12.27/24.

10.3 DA Master / Worker

DA Master example:

set interface management ip 192.168.122.3/24
set interface management gateway 192.168.122.1
set interface management dns 8.8.8.8
set hostname da-master
reboot

After reconnecting:

set role resource
show interface all
set cluster_interface <cluster-interface>
set interface cluster ip 192.168.12.50/24
set cm 192.168.12.25
reset

Use unique values for DA workers, such as da-worker1 / 192.168.12.51/24.

10.4 Convert DA Resource to DA-Master

When DL Master is System Ready and the intended DA Master reports resource:

Open the Data Platform GUI.
Go to System → DATA MANAGEMENT → Resources and verify the DA resource is ready.
Go to System → DATA MANAGEMENT → Data Analyzer.
Create a Data Analyzer cluster.
Select the DA resource and set Role in Cluster to DA-Master.
Submit and verify the node becomes healthy.

10.5 Receiver and Sensor Profile

Open System → DATA SOURCE MANAGEMENT → Receivers.
Confirm Receiver Hostname points to DA-Master, not DL-Master.
Confirm at least one Sensor Profile points to the receiver.
If show logforwarder has no output, check Receiver Hostname first.

10.6 DP Final Checklist

DL/DA VMs are running and autostart is enabled.
DL management IP is 192.168.122.2/24; DA management IP is 192.168.122.3/24.
Every cluster node has a unique hostname and cluster IP.
The actual cluster interface was selected from show interface all.
All nodes use the DL Master cluster IP as CM; this guide uses 192.168.12.25.
The intended vdb storage is added where required.
DA-Master is healthy in Data Analyzer.
Receiver Hostname points to DA-Master and the Sensor Profile points to that receiver.
Full Configuration Validation has no unresolved FAIL.

For the same post-deployment commands without the installer walkthrough, use DP Cluster Initial Configuration.

​DP KVM Installer User Guide

​Overview

​1. System Architecture

​Validated Dell PowerEdge R650 / R660 / R670 Configuration

​Hardware at a Glance

​Architecture Overview

​2. Pre-Installation Preparation

​System Requirements

​Documented Operating System

​Preparation Steps

​Management NIC

​Cluster NIC

​Host Access NIC

​NIC Preparation and Design Guidance

​3. Installer Navigation

​Navigation

​State-Aware Execution

​Mandatory Reboot Steps

​Main Menu Overview

​1. Auto Execute All Steps

​2. Select and Run Specific Step Only

​3. Configuration

​4. Full Configuration Validation

​5. Script Usage Guide

​6. View Log

​7. Exit

​4. Installation Scenarios

​4.1 New Installation

​Initial Configuration

​Auto Execute

​Mandatory Reboot Steps

​After Reboot

​4.2 Run a Specific Step

​Common Use Cases

​How to Run a Specific Step

​STEP 14 — NFS Backup Server

​Important Notes

​5. Post-Installation Validation

​Validation Scope

​6. Common Post-Installation Changes

​Automatic Reboot Notice

​Change Scenarios

​Change Management or Host Access NIC / IP

​Change Cluster NIC

​Redeploy DLm / DAm VM

​Deploy a Different DLm / DAm Version

​7. After DLm / DAm Deployment

​Default Network Configuration

​Web UI Access

​CLI Access

​SSH Access

​8. Hardware and Software Requirements

​9. BIOS and Platform Configuration

​10. Required DP Initial Configuration

​10.1 DL Master

​10.2 DL Worker

​10.3 DA Master / Worker

​10.4 Convert DA Resource to DA-Master

​10.5 Receiver and Sensor Profile

​10.6 DP Final Checklist

DP KVM Installer User Guide

Overview

1. System Architecture

Validated Dell PowerEdge R650 / R660 / R670 Configuration

Hardware at a Glance

Architecture Overview

2. Pre-Installation Preparation

System Requirements

Documented Operating System

Preparation Steps

Management NIC

Cluster NIC

Host Access NIC

NIC Preparation and Design Guidance

3. Installer Navigation

Navigation

State-Aware Execution

Mandatory Reboot Steps

Main Menu Overview

1. Auto Execute All Steps

2. Select and Run Specific Step Only

3. Configuration

4. Full Configuration Validation

5. Script Usage Guide

6. View Log

7. Exit

4. Installation Scenarios

4.1 New Installation

Initial Configuration

Auto Execute

Mandatory Reboot Steps

After Reboot

4.2 Run a Specific Step

Common Use Cases

How to Run a Specific Step

STEP 14 — NFS Backup Server

Important Notes

5. Post-Installation Validation

Validation Scope

6. Common Post-Installation Changes

Automatic Reboot Notice

Change Scenarios

Change Management or Host Access NIC / IP

Change Cluster NIC

Redeploy DLm / DAm VM

Deploy a Different DLm / DAm Version

7. After DLm / DAm Deployment

Default Network Configuration

Web UI Access

CLI Access

SSH Access

8. Hardware and Software Requirements

9. BIOS and Platform Configuration

10. Required DP Initial Configuration

10.1 DL Master

10.2 DL Worker

10.3 DA Master / Worker

10.4 Convert DA Resource to DA-Master

10.5 Receiver and Sensor Profile

10.6 DP Final Checklist