Installing Timebeat Synchronisation Software

Timebeat software installation guide

Timebeat can be downloaded at https://timebeat.app/downloads

Deploying to Linux

Open up a terminal and run the following commands:

Copy

sudo rpm -ivh timebeat<version-number/full-file-name>.rpm

If the operation works correctly, you should see an output similar to the terminal below.

Copy

Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
   1:timebeat-1.2.1-1 ################################# [100%]

That's all it takes to get the Timebeat agent installed.

We need to configure the config file to ensure that your Timbeat application can source UTC and report to Elastic (or file). For this, we will need to edit the following file:

Copy

/etc/timebeat/timebeat.yml

For configuration details, please see the configuration examples.

Next, we need to ensure your License file is in the correct location. We recommend that this is placed in the following location:

Copy

/etc/timebeat/timebeat.lic

Although this location is not necessary, it is the default location within the timebeat.yml configuration file. Therefore, if you place the license in a different path location, make sure to update the path within the configuration file as well.

To obtain a license, just fill out the form at https://www.timebeat.app/services/downloads

Once complete, the license will arrive in your inbox in seconds.

Assuming your dependencies are set up, and your config file is updated, you are ready to start the Timebeat service. We recommend running the following command to start the service in the foreground after config changes. This command will highlight any errors that may be present in the config file so that you can quickly amend and restart the service.

Copy

sudo /usr/share/timebeat/bin/timebeat -c /etc/timebeat/timebeat.yml -path.home /usr/share/timebeat -path.config /etc/timebeat -path.data /var/lib/timebeat -path.logs /var/log/timebeat -e

Once you are comfortable that the service is operating as you expect, you can start the service normally with the below commands:

Copy

sudo systemctl start timebeat

To check that Timebeat is running, you can check the status with:

Copy

sudo systemctl status timebeat

It is also recommended that you run the following command at this stage to enable Timebeat at startup so that you are not caught without synchronisation during system restarts.

Copy

sudo systemctl enable timebeat

Deploying to Windows

Assuming you have downloaded the Timebeat software to a directory on the local device and you can operate with administrator privileges:

Unzip the contents of the zipped Timebeat file

Copy the unzipped folder and place it within Program Files

Open up a PowerShell window as administrator and change the directory to Program files

From here you may need to change the execution policy depending on your current Windows configuration. In order to run the Timebeat installer, you will need to configure the execution policy to Unrestricted.

Run the following command within the Program Files folder

Copy

Set-ExecutionPolicy Unrestricted

When carried out correctly you will receive the below output within the PowerShell window at which point select [Y]. Depending on the Windows O/S release other options may be available in which case select the option which best represents the outcome you desire.

Copy

PS C:\Program Files> set-ExecutionPolicy Unrestricted

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
http://go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):

Now enter the Timebeat folder and run the following commands:

Copy

.\install-service-timebeat.ps1

If you have not carried out the ExecutionPolicy correctly, you will see output to the PowerShell window similar to the one below.

Copy

PS C:\Program Files\timebeat-1.2.1-windows-x86_64> .\install-service-timebeat.ps1
.\install-service-timebeat.ps1 : File C:\Program Files\timebeat-1.2.1-windows-x86_64\install-service-timebeat.ps1
cannot be loaded. The file C:\Program Files\timebeat-1.2.1-windows-x86_64\install-service-timebeat.ps1 is not
digitally signed. You cannot run this script on the current system. For more information about running scripts and
setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\install-service-timebeat.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess

If the ExecutionPolicy is correctly set you will be greeted with the below PowerShell output:

Copy

PS C:\Program Files\timebeat-1.2.1-windows-x86_64> .\install-service-timebeat.ps1

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Program Files\timebeat-1.2.1-windows-x86_64\install-service-timebeat.ps1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):

At this stage select [R] to continue the process. Once [R] is selected the following output will appear:

Copy

Status Name DisplayName
------ ---- -----------
Stopped timebeat timebeat

To complete the installation you will need to run the installation PowerShell Script one more time which will look like the below (be aware you will need to respond with [R] again:

Copy

PS C:\Program Files\timebeat-1.2.1-windows-x86_64> .\install-service-timebeat.ps1

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Program Files\timebeat-1.2.1-windows-x86_64\install-service-timebeat.ps1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"): R


__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 5
PSComputerName :

__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 0
PSComputerName :

Status : Stopped
Name : timebeat
DisplayName : timebeat

That's all it takes to get the Timebeat agent installed. Now we need to configure the config file to ensure that your Timebeat application can source UTC and report to elastic. For this we will need to edit the following file:

Copy

C:\\Program Files\timebeat<version-number/full-file-name>\timebeat.yml

For configuration details please see the configuration guides.

Next, we need to make sure your License file is in the correct location. We recommend that this is placed in the following location:

Copy

C:\\Program Files\timebeat<version-number/full-file-name>\timebeat.lic

Although this location is not necessary it is recommended for ease. You will need to update the default location within the timebeat.yml configuration file, therefore if you place the license in a different path location make sure to update the path within the configuration file as well. Unlike with Linux installations the pathname will need to be within single quotes (this is the same for all path locations) an example would look like the below:

Copy

'C:\Program Files\timebeat-1.2.1-windows-x86_64\timebeat.lic'

To obtain a license just fill out the form at https://timebeat.app/license.php

Once complete the license will arrive in your inbox in seconds.

Assuming your dependencies are set up and your config file is updated, you are ready to start the Timebeat service. We recommend that you run the following command to start the service in the foreground after any config changes. Running this command will highlight any errors that may be present in the config file so that you can quickly amend and restart the service.

The following command will run Timebeat in the foreground of the PowerShell window provided you are within the Timebeat file directory location, if you are not in the Timebeat file directory then just add the full pathname to the front of the timebeat.exe:

Copy

.\timebeat.exe -d “*” -e

Once you are comfortable that the service is operating as you expect you can start the service normally with the below commands:

Copy

Start-Service timebeat

Similarly, you can navigate to the services tab within Task manager and start the service from there.

To check that Timebeat is running you can check the status by:

Opening up Task Manager and finding Timebeat within the services tab and checking that the status is Running

The Gotchas/tasks to remember

Sometimes you will have followed the above steps but you still can't get Timebeat to work.

Below we provide some insight into the common items which are overlooked or forgotten about.

Firewalld : You have the options to configure firewalld or in most cases, we recommend simply turning it off or disabling it with the below commands.

Copy

sudo systemctl stop firewalld
sudo systemctl disable firewalld

Windows Firewall / Defender: Similarly on windows you need to disable (or configure) Windows Firewall and Windows Defender.
This is done in the command panel, just ensure the necessary boxes are ticked with off.

License Key : This solution is the same for many items in Timebeat configuration. Always check your path names are accurate and correct, you can't always rely on the default values even if in most cases this would be fine. Ensure your license key has the correct file name and matches that to what you have configured within the timebeat.yml file.

Pathname defaults : This sometimes takes a bit of trial and error and as such we always recommend starting Timebeat within the terminal when you start for the first time after making config changes - especially when moving config files between operating systems. Timebeat on Linux defaults with pathnames with "/" where as Windows will use "\" similarly Linux uses the double quote " " but Windows uses single quotes ' ' Double check these are correct. Again using the debug command above (-d "*" flag) allows you to identify the line of the config file which is proving problematic.

YAML: One thing to always remember when modifying the yaml file is that you have to use spaces and not tabs. If you use tabs the file will not be read correctly and as a word from the wise, a tab is near impossible to locate as it appears the same as spaces.

Getting Started - Timebeat software installation guide

Deploying to Windows

The Gotchas/tasks to remember