Debug Commands

The Falcon LogScale Collector Debug API supports the following commands:

Command Description
Monitor This command enables you to see a live view of the running state of the Falcon LogScale Collector.
Query These commands allows you to query using one of the following arguments:

  • metrics: returns the metrics as a JSON object.

  • internallogs: fetches debug log of a running LogScale Collector through the local API.

Export This command exports an all-in-one debug file which can be used for troubleshooting.

The local API used to access these commands is enabled by default and listens on:

  • Windows: Named pipe which is restricted to administrators

  • Linux and macOS: Unix socket located inside the data directory, restricted to the service user and group

To disable the local API, add the following to the config file:

yaml
api:
  enabled: false
Query Internal Logs and Metrics

The query command can be used to query metrics or internal logs:

Internal Logs

The internallogs command fetches the debug log of a running Falcon LogScale Collector through the local API, without having to restart or reconfigure the service. The debug log via local API is unfiltered, and is not affected by --log-level, logLevel or the internal debug log sender feature.

shell
logscale-collector query internallogs --cfg <path to config>
Metrics

The metrics command returns the metrics of pipelines for collecting data. The metrics include meters and gauge describing the flow of data through the ___lc__name__.

The metrics can be retrieved as JSON via:

shell
logscale-collector query metrics --cfg <path to config>
Export Internal Logs

This command can help troubleshoot an installation by creating an all-in-one debug file that can be shared with support.

The export-debug command connects to the local API to pull the running state, metrics and debug log without disturbing the running sources and sinks. The command creates a file called debug.zip in the current directory. The file contains the following information:

  • The fleet management mode and server URL listed in the configuration file.

  • The errors and warnings emitted from parsing the configuration file.

  • The running version of the LogScale Collector service.

  • The id of the LogScale Collector service.

Additionally, you can run commands to export metrics and internal logs.

Run the following command to export the debug file:

shell
logscale-collector export-debug --cfg <path to config>