LogScale Self-Hosted Deployment
This manual covers the deployment of Falcon LogScale Self-Hosted versions 1.172.0-1.177.0. Self-hosted deployment means that you manage an your own installation of LogScale. This can be a bare metal, virtual server, private cloud, or a public cloud environment. This is different to using LogScale Cloud, where the infrastructure is managed by CrowdStrike.
In this documentation you will learn about planning for, and installing, your own self-hosted LogScale cluster. While you can install the requirements directly onto physical or virtual servers, the preferred method is to use containers and Kubernetes to deploy the cluster. You can run your Kubernetes cluster on your own servers, or using a public Kubernetes managed service such as Amazon Elastic Kubernetes Service (EKS).
LogScale also requires an Apache Kafka cluster. Again, this can be installed directly on to your own servers, or implemented using a public managed service such as Amazon Managed Streaming for Apache Kafka (MSK).
When running LogScale on your own infrastructure there are a number of different methods and considerations to take into account. For background on how LogScale is typically deployed, see LogScale Physical Architecture.
Step-by-Step Guide to LogScale Deployment
The following provides a step-by-step guide to planning and implementing your LogScale deployment:
Decide on the type of deployment you want to achieve. You could use physical or virtual servers, and optionally use containers. See Planning Your Deployment for further information. Once you have decided on your main deployment approach (for example, you might use containers on AWS), check the system requirements. See System Requirements for further information. Check the capacity planning guidelines to understand the various factors in determining how to size your deployment. This guide will help you determine requirements for CPU cores, RAM, storage and so on, depending on your specifc use case. See Provisioning for further information. Decide on your storage architecture. You need to decide on the parts played by primary, secondary and bucket storage. You also need to know how to size these according to your use case (factors such as ingest load and retention times will be among several important factors here). See Storage Architecture for further information. Choose a reference architecture for your deployment. The reference architectures provide you with a tried and tested way to get your LogScale deployment up and running. You can then modify this according to your needs. See Reference Architectures for further information. If not already installed as part of the reference architecture, you may need to install load balancers to distribute the load to the nodes in your LogScale cluster. See Installing Load Balancers for further information. Optionally install auxiliary services such as a PDF renderer for PDF reports. See Deploying Auxiliary Services for further information. You are now ready to test your deployment. Plans to help you test all aspects of your deployment are provided. See Testing Your Deployment for further information.
See the links below for further information:
This section provides details of recommended planning to be carried out before the installation and deployment of LogScale. This covers subjects such as preferred deployment option, sizing guides, and system requirements.
This section provides details on how to install Falcon LogScale using containers. This is the preferred method of deploying your LogScale cluster.
Installing On Bare Metal or Cloud Instance
This section provides details on how to install Falcon LogScale on physical or virtual servers. While this method enables complete control of every facet of your installation, it requires considerably expertise to manage and scale this method of deployment.
This section provides you with some stretegies for testing your deployment.