Internal Logging

Internal logging can be enabled and disabled from Fleet Management without having to set environment variables, this means internal logging can be enable/disabled without restarting the Falcon LogScale Collector and it makes it possible to dynamically change verbosity (internal log level).

Enable Internal Logging

  1. Go to LogScale and click Data Ingest. The Fleet overview page will load with all the Falcon LogScale Collectors which have been configured for fleet management and/or enrolled in remote config file management.

  2. Click Fleet Overview on the left menu. The page will be displayed with the details listed above. Use the filter boxes to filter by status and/ or the assigned configuration.

  3. Click the ellipsis next to the Falcon LogScale Collector instance and click Manage Internal Logging

    Enable Logging

    Figure 40. Enable Logging


  4. Click Enable to enable logging.

  5. Click either:

    • Send to repository, select the required log level, a repository and an ingest token from the drop down menus and click Save changes.

    • Send to different instance, select the instance to send the logs to, the log level and an ingest token.

    Send to Repository

    Figure 41. Send to Repository


Change Internal Logging Settings

  1. Go to LogScale and click Data Ingest. The Fleet overview page will load with all the Falcon LogScale Collectors which have been configured for fleet management and/or enrolled in remote config file management.

  2. Click Fleet Overview on the left menu. The page will be displayed with the details listed above. Use the filter boxes to filter by status and/ or the assigned configuration.

  3. Click the ellipsis next to the Falcon LogScale Collector instance and click Manage Internal Logging .

    Logging

    Figure 42. Logging


  4. Click a tab:

    • the Disable tab and click Disable to stop logging for the instance selected.

    • Send to repository tab to change or set up the details for logging to repository, select the required log level, a repository and an ingest token from the drop down menus and click Save changes.

    • Send to different instance tab to change or set up logging to another Falcon LogScale instance, insert the URL of the instance to send the logs to, the log level and an ingest token.