Installing LogScale Collector on Linux - Custom

This procedure describes how to perform a custom installation of the LogScale Collector on a Linux.

  1. Download the LogScale Collector as described in Downloading LogScale Collector - Custom or using the command-line, see Downloading Installers from the Command-line.

  2. Run the following command to install Falcon LogScale Collector on:

    • Ubuntu

      shell
      dpkg -i humio-collector_x.x.x_linux_amd64.deb

    • RedHat

      shell
      $ rpm -i humio-collector.rpm
Running the LogScale Collector Manually on Linux

The following procedures allow you to install LogScale Collector on Linux manually.

Configuring Start-up on Boot

The package ships with a service file that can be enabled as a SystemD service to run at start-up by running:

shell
$ sudo systemctl start humio-log-collector.service

And configured to start on boot using:

shell
$ sudo systemctl enable humio-log-collector.service
Running the LogScale Collector Manually

You can run the LogScale Collector as a standalone process and ignore the service file etc.

shell
$ humio-log-collector -cfg /etc/humio-log-collector/config.yaml

The executable humio-log-collector is located in /usr/bin by default.

Additional Steps on Linux
Granting Access to Logs on Ubuntu

You can now grant access to system logs, By default, the logscale-collector (Custom install humio-log-collector) process will run as the logscale-collector user, which is installed by the package and won't have access to logs in /var/log. This can be granted by adding the user to the adm group.

this can be granted by adding the user to the adm group.

shell
$ sudo usermod -a -G adm humio-log-collector

Note

Running the LogScale Collector as the root user is not recommended.

Granting Access to Logs on RedHat

To access log files you need to have read rights on the system, you can add the following to your SystemD unit file to grant read access to all files.

Important

This provides broad access to all system files and therefore is not recommend for anything other than testing purposes.

ini
AmbientCapabilities = CAP_DAC_READ_SEARCH;

We recommend using specific access permissions to files or using ACLs, for example access systemd journal can be granted using the following:

shell
$ sudo usermod -a -G systemd-journal humio-log-collector
Binding to the Standard Syslog Port

Only root users can bind to port < 1024. To bind to a lower port number you can give special permissions to the logscale-collector binary.

shell
$ sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/humio-log-collector
$ sudo systemctl restart humio-log-collector
Firewall Configuration

If a firewall has been configured on your system it may interfere with the sending of Syslog data. The firewall configuration will need to be updated to allow the default syslog port, 1515, through the firewall.

On RedHat or Debian Linux installations this can be achieved using the command:

shell
$ sudo firewall-cmd --add-port=1515/tcp  --permanent

Other Linux installations may need a different configuration.