LogScale Self-Hosted Deployment
This manual covers the deployment of Falcon LogScale Self-Hosted versions 1.214.0-1.219.0. Self-hosted deployment means that you manage your own installation of LogScale. This can be a bare metal, virtual server, private cloud, or a public cloud environment. This is different to using LogScale Cloud, where the infrastructure is managed by CrowdStrike.
In this documentation you will learn about planning for, and installing, your own self-hosted LogScale cluster. While you can install the requirements directly onto physical or virtual servers, the preferred method is to use containers and Kubernetes to deploy the cluster. You can run your Kubernetes cluster on your own servers, or using a public Kubernetes managed service such as Amazon Elastic Kubernetes Service (EKS).
LogScale also requires an Apache Kafka cluster. Again, this can be installed directly on to your own servers, or implemented using a public managed service such as Amazon Managed Streaming for Apache Kafka (MSK).
When running LogScale on your own infrastructure there are a number of different methods and considerations to take into account. For background on how LogScale is typically deployed, see LogScale Physical Architecture.
Why Deploy Self-Hosted LogScale?
Before deploying self-hosted LogScale, you need to understand whether it is the best option for your use case. It may be that LogScale Cloud is the best option. The following table compares LogScale in Cloud or Self-Hosted deployments:
| LogScale Cloud | LogScale Self-Hosted |
|---|---|
| Fully managed by CrowdStrike - no infrastructure overhead | Full control over infrastructure and data placement |
| Faster time to value - quick onboarding and setup | Customizable hardware and resource allocation |
| Automatic updates and patches handled by CrowdStrike | Can be deployed in air-gapped or restricted environments |
| Built-in scalability and high availability | Meets strict data sovereignty and compliance requirements |
| Reduced operational burden on internal teams | Flexibility to integrate with existing on-prem infrastructure |
| Predictable SaaS pricing model | Potential cost savings at very large scale with owned hardware |
| Less control over data residency and placement | Requires dedicated internal resources to manage and maintain |
| Dependent on internet connectivity | Longer deployment and setup time |
| May not meet all air-gapped or strict compliance needs | Responsible for your own updates, patches, and upgrades |
| Customization options may be more limited | Higher upfront infrastructure investment |
| Ongoing SaaS costs can scale with data volume | Scaling requires manual capacity planning and hardware procurement |
Step-by-Step Guide to LogScale Deployment
The following provides a step-by-step guide to planning and implementing your LogScale deployment:
Decide on the type of deployment you want to achieve. You could use physical or virtual servers, and optionally use containers. See Planning Your Deployment for further information.
Once you have decided on your main deployment approach (for example, you might use containers on AWS), check the system requirements. See System Requirements for further information.
Check the capacity planning guidelines to understand the various factors in determining how to size your deployment. This guide will help you determine requirements for CPU cores, RAM, storage and so on, depending on your specific use case. See Instance Sizing for further information.
Decide on your storage architecture. You need to decide on the parts played by primary, secondary and bucket storage. You also need to know how to size these according to your use case (factors such as ingest load and retention times will be among several important factors here). See Storage Architecture for further information.
Choose a reference architecture for your deployment. The reference architectures provide you with a tried and tested way to get your LogScale deployment up and running. You can then modify this according to your needs. See Reference Architectures for further information.
If not already installed as part of the reference architecture, you may need to install load balancers to distribute the load to the nodes in your LogScale cluster. See Installing Load Balancers for further information.
Optionally install auxiliary services such as a PDF renderer for PDF reports. See Deploying Auxiliary Services for further information.
You are now ready to test your deployment. Plans to help you test all aspects of your deployment are provided. See Testing Your Deployment for further information.
See the links below for further information:
This section provides details of recommended planning to be carried out before the installation and deployment of LogScale. This covers subjects such as preferred deployment option, sizing guides, and system requirements.
This section provides details on how to install Falcon LogScale using containers. This is the preferred method of deploying your LogScale cluster.
Installing On Bare Metal or Cloud Instance
This section provides details on how to install Falcon LogScale on physical or virtual servers. While this method enables complete control of every facet of your installation, it requires considerably expertise to manage and scale this method of deployment.
This section provides you with some strategies for testing your deployment.