Download
Everything ships as a self-contained artifact with published SHA-256 checksums — no account, no telemetry. The platform to deploy, and LUnA, the universal agent, to feed it.
The platform
Ingest, search, alerting, dashboards, and the topology editor on the free Community
tier. No license file, nothing to activate — a starter pipeline is deployed for you, so
your first log line is searchable minutes after docker compose up. The
detection engine, MCP server, object-storage archival and monitoring stack come with
licensed deployments.
A Docker host with Compose v2, 4 CPU cores and 24 GB of RAM free, and outbound
access to registry.logrok.com. Evaluating fully air-gapped?
Talk to us for a pre-loaded image bundle.
logrok-compose-trial-1.4.2.tar.gz
(206 KB)
SHA-256 4de519ccb105dc71… — full hash in the release manifest.
The hardened production form: AlmaLinux with FIPS 140-3 validated crypto and DISA STIG hardening, TLS out of the box, one-click in-product upgrades — current release 1.4.2.
ESXi, vSphere, and Workstation. Import via the vSphere Client or File → Open.
Download (5.2 GB)
SHA-256 f5e1307adf3704eb…
KVM and Proxmox. Import with virt-install or the Proxmox UI.
Download (9.8 GB)
SHA-256 2f76ea349de1164d…
Generation 2 VM, UEFI boot, Secure Boot off.
Download (10.8 GB)
SHA-256 1543a5ab25321a0a…
Latest release: logrok 1.4.2 (7 October 2026). Ships with syslog-ng 4.12.0, Apache Doris 4.1.1, Keycloak 26.6.2, PostgreSQL 16 and AlmaLinux 9.2. Licensed compliance packs: DORA, NIS2 and PCI DSS. Helps meet HIPAA and GDPR audit-logging requirements.
The chart is published with every release in the same registry as the images (chart version = release version, currently 1.4.2). It deploys the platform against your own PostgreSQL 16+, Keycloak 26+ and Apache Doris 4+ and defaults to the FIPS images. Air-gapped? Pull the chart and mirror the images first.
helm install logrok oci://registry.logrok.com/logrok/charts/logrok \
--version <X.Y.Z> --namespace logrok --values my-values.yamlThe universal agent
The collection front door: forwards standard syslog into logrok or any aggregator, with OTLP, Splunk HEC and the other native destinations available on Apex. The free Core tier runs unmanaged out of the box; Apex features unlock with a license. Always the latest stable release.
Windows 10 and 11, Server 2016+. Authenticode-signed installer.
msiexec /i luna-windows-amd64.msi /qnRuns as a systemd service. x64, arm64 and armv7.
sudo dpkg -i luna-linux-amd64.deb # or: sudo rpm -i luna-linux-x86_64.rpmIntel and Apple Silicon. Unsigned for now, so Gatekeeper will warn.
sudo installer -pkg luna-darwin-arm64.pkg -target /Multi-arch (amd64 and arm64), cosign-signed.
docker pull ghcr.io/logiqum/luna:latestCross-compiled static binaries, runtime-unverified. Provided for evaluation on the listed platforms.
Also on every release page: LUnA Crescent, a smaller edition for OT gateways, appliances and single-board computers, and luna-migrate, which converts another forwarder's configuration into a LUnA one and reports anything it could not carry over.
Every agent release, checksum & signature on GitHub — github.com/logiqum/luna
Every artifact publishes a SHA-256 checksum. Every agent file is covered by one signed checksum list, and the agent's packages, Windows installers and container image are signed too. On a security product, don't skip this.
Platform artifacts (trial & appliances)
# each artifact's SHA-256 is published in the release manifest
curl -s https://updates.logrok.com/manifest.json | grep -A3 '"version": "1.4.2"'
sha256sum logrok-*.tar logrok-*.{ova,qcow2,vhdx}Agent downloads (LUnA): check the signature, then the file
curl -LO https://github.com/logiqum/luna/releases/latest/download/SHA256SUMS
curl -LO https://github.com/logiqum/luna/releases/latest/download/SHA256SUMS.cosign.bundle
cosign verify-blob --key https://raw.githubusercontent.com/logiqum/luna/main/cosign.pub \
--bundle SHA256SUMS.cosign.bundle SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missingOr with gpg alone (deb, rpm and SHA256SUMS are OpenPGP-signed)
curl -LO https://raw.githubusercontent.com/logiqum/luna/main/logrok-release-signing.asc
gpg --show-keys --with-fingerprint logrok-release-signing.asc
# must show B9BE 1899 A736 BA2C 4B3C 23BF 2BE4 7268 770B 0C3F
gpg --import logrok-release-signing.asc
curl -LO https://github.com/logiqum/luna/releases/latest/download/SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMSAgent container signature (cosign)
cosign verify --key https://raw.githubusercontent.com/logiqum/luna/main/cosign.pub \
ghcr.io/logiqum/luna:latestAppliances upgrade from the in-product Upgrade page — it finds new releases in the manifest and applies the signed bundle for you (current: 1.4.2). Air-gapped appliances side-load the same bundle.
Upgrade bundle 1.4.2 SHA-256: 4a8ae79c82cd3a31c8b731f33d037bca926dd877ff91e29d2322011c7a19cad3
Compose deployments upgrade by bumping one version variable — the kit's bundled helper
script does it with a rollback safety net. Kubernetes deployments use
helm upgrade (and helm rollback). Images are pulled from
registry.logrok.com.
Every artifact's SHA-256 is published in the release manifest; upgrade bundles are additionally signed and verified by the appliance before applying.
The platform's Community trial is free to evaluate. For the agent, Luna Core is free — for non-commercial use, alongside a licensed logrok deployment, and for commercial fleets up to 10 agents. Core collects from the host and forwards one open standard: RFC 5424 syslog over TCP/TLS, to one destination. Encryption is never a paid feature. Apex covers everything else — Windows Event Log, ETW, WMI and Linux audit collection, fleet management, per-agent mTLS, macOS, Kubernetes, the air-gap diode, edge reduction, and every destination other than standard syslog (the full list is on the LUnA page) — issued free with logrok, or purchased standalone. By downloading and running the agent you accept the Logiqum End User License Agreement, the same agreement that covers logrok.