Debug Commands

The Falcon LogScale Collector Debug API supports the following commands:

Command Description
Monitor This command enables you to see a live view of the running state of the Falcon LogScale Collector.
Query These commands allows you to query using one of the following arguments:

  • metrics: returns the metrics as a JSON object.

  • internallogs: fetches debug log of a running LogScale Collector through the local API.

Export This command exports an all-in-one debug file which can be used for troubleshooting.

The local API used to access these commands is enabled by default and listens on:

  • Windows: Named pipe which is restricted to administrators

  • Linux and macOS: Unix socket located inside the data directory, restricted to the service user and group

To disable the local API, add the following to the config file: 

api:
  enabled: false
Monitor Falcon LogScale Collector Instances

The monitor command launches a monitor terminal application. The monitor mode can be used to see a live view of the running state of the Falcon LogScale Collector. The running sources, queues and sinks can be inspected in real time.

Start the monitor by running the following command:

shell
logscale-collector monitor --cfg path/to/config.yaml

Once you have run the command the monitor terminal application is displayed with details on the specified instance.

Monitor

Figure 44. Logging


Query Internal Logs and Metrics

The query command can be used to query metrics or internal logs:

Internal Logs

The internallogs command fetches the debug log of a running Falcon LogScale Collector through the local API, without having to restart or reconfigure the service. The debug log via local API is unfiltered, and is not affected by --log-level, logLevel or the internal debug log sender feature.

shell
logscale-collector query internallogs --cfg <path to config>
Metrics

The metrics command returns the metrics of pipelines for collecting data. The metrics include meters and gauge describing the flow of data through the ___lc__name__.

The metrics can be retrieved as JSON via:

shell
logscale-collector query metrics --cfg <path to config>
Export Internal Logs

This command can help troubleshoot an installation by creating an all-in-one debug file that can be shared with support.

The export-debug command connects to the local API to pull the running state, metrics and debug log without disturbing the running sources and sinks. The command creates a file called debug.zip in the current directory. The file contains the following information:

  • The fleet management mode and server URL listed in the configuration file.

  • The errors and warnings emitted from parsing the configuration file.

  • The running version of the LogScale Collector service.

  • The id of the LogScale Collector service.

Additionally, you can run commands to export metrics and internal logs.

Run the following command to export the debug file:

shell
logscale-collector export-debug --cfg <path to config>