Falcon LogScale Collector Manage your Fleet
Falcon LogScale Collector Data ingest tab provides a set of functionalities which allow you to monitor and manage a fleet of collector instances.
There are two different approaches to managing your fleet, you can either use;
Fleet Management with Remote Configuration Management (recommended method) which allows you to monitor the status of your instances and;
manage your configuration files using an editor which validates the file as you type,
reuse configurations across groups of collectors which also means you can roll out a change to multiple instances easily,
extend configurations
test out new configurations without impacting log collection.
Fleet Management with Local Configuration files this method allows you to monitor the status of your Falcon LogScale Collector instances but manage the configuration files manually.
You can also use these pages to perform the steps required work with Falcon LogScale Collector locally or remotely (using centralized management):
Manage Falcon LogScale Collector Instance Enrollment and configure any required Enrollment Token Options.
View the status of your fleet on the Manage Your Fleet page.
 |
Figure 14. Fleet Overview
Fleet Management Internal Logging
Internal logging can be enabled and disabled from Fleet Management without having to set environment variables, this means internal logging can be enable/disabled without restarting the Falcon LogScale Collector and it makes it possible to dynamically change verbosity (internal log level).
Enable Internal Logging
Go to LogScale and click Data Ingest. The Fleet overview page will load with all the Falcon LogScale Collectors which have been configured for fleet management and/or enrolled in remote config file management.
Click on the left menu. The page will be displayed with the details listed above. Use the filter boxes to filter by status and/ or the assigned configuration.
Click the ellipsis next to the Falcon LogScale Collector instance and click
Figure 40. Enable Logging
Click to enable logging.
Click either:
, select the required log level, a repository and an ingest token from the drop down menus and click .
, select the instance to send the logs to, the log level and an ingest token.
Figure 41. Send to Repository
Change Internal Logging Settings
Go to LogScale and click Data Ingest. The Fleet overview page will load with all the Falcon LogScale Collectors which have been configured for fleet management and/or enrolled in remote config file management.
Click on the left menu. The page will be displayed with the details listed above. Use the filter boxes to filter by status and/ or the assigned configuration.
Click the ellipsis next to the Falcon LogScale Collector instance and click .
Figure 42. Logging
Click a tab:
the tab and click to stop logging for the instance selected.
tab to change or set up the details for logging to repository, select the required log level, a repository and an ingest token from the drop down menus and click .
tab to change or set up logging to another Falcon LogScale instance, insert the url of the instance to send the logs to, the log level and an ingest token.