Back Up and Restore Your Installation

This documentation provides instructions for backing up and restoring Falcon LogScale Collector installations, including procedures for preserving checkpoint databases, disk queues, and configuration files. The guide covers backup procedures, restoration steps, and important considerations regarding duplicate events and re-enrollment requirements.

Overview

Backing up the Falcon LogScale Collector requires preserving state across two locations: dataDirectory (checkpoint database and disk queues) and config.yaml.

  • Checkpoint database (dataDirectory): Prevents re-ingesting all events from before the backup.

  • Disk queues (dataDirectory): Holds events not yet sent to the destination. Without this backup, that data can be lost.

  • config.yaml: Contains local configuration changes.

Additionally, the Log Collector requires re-enrollment to obtain a valid access token. The current token can be rolled.

How to Back Up Your Installation

Important

The name of the Falcon LogScale Collector service varies:

  • If you use Full Installation the service is called logscale-collector,

  • If you installed using Custom Installation or a version prior to 1.361.1 of Falcon LogScale the service name is humio-log-collector. This does not apply to macOS.

Use your organization's approved backup procedures and tools to back up the files and locations listed below.

  1. Stop the Log Collector service.

  2. Back up config.yaml and dataDirectory.

    Standard locations:

    • Linux (Full Install):

      config.yaml: /etc/logscale-collector/config.yaml

      dataDirectory: /var/lib/logscale-collector/

    • Linux (Custom Install):

      config.yaml: /etc/humio-log-collector/config.yaml

      dataDirectory: /var/lib/humio-log-collector/

    • Windows:

      config.yaml: C:\Program Files (x86)\CrowdStrike\Humio Log Collector\config.yaml

      dataDirectory: C:\ProgramData\LogScale Collector\

    • macOS:

      config.yaml: /usr/local/etc/logscale-collector/config.yaml

      dataDirectory: /var/local/logscale-collector/

  3. Restart the service.

Note

Depending on the configuration, the queue storage files might have different locations.

How to Restore Your Installation

  1. Run the Full Install or enroll command (depending on the install method used). See Full Installation or Custom Installation for more information.

  2. Stop the service.

  3. Restore the config.yaml, database.db and optionally any queue storages in the dataDirectory using your backup tool.

    Ensure that your restore procedure matches your backup method.

  4. Start the service.

Duplicate Events

Restoring from a backup resets read checkpoints to the backup point in time. Any events ingested after that point will be re-ingested and appear twice.

Restore from Snapshot

When restoring from a VM or File System snapshot (such as snapshots taken before OS upgrades), you only need to re-enroll. The snapshot already preserves the entire file system including the Log Collector files. Run the Full Install or enroll command with a valid install token. Full Install overwrites the local config.yaml, so back it up beforehand and restore it afterwards.