Install Falcon LogScale Collector on macOS - Custom

This procedure describes how to perform a custom installation of the Falcon LogScale Collector on a macOS.

  1. Download the Falcon LogScale Collector as described in Download Falcon LogScale Collector - Custom or using the command-line, see Download Installers from the Command-line.

  2. Double click the installer.

  3. You can use the following command to run and enroll your Log Collector in Manage Your Fleet and specify the enrollment token.

    Note

    Create a valid configuration before running the Log Collector, see Configure Falcon LogScale Collector for more information.

    shell
    $ sudo logscale-collector enroll enrolltoken

    If you want to manage your configuration manually you must follow the steps described in, Running Falcon LogScale Collector Manually on macOS

    Note

    Errors and warnings are logged to /var/log/logscale-collector/main.log

Running Falcon LogScale Collector Manually on macOS

The following procedures describe how to perform a set of optional manual steps, which allow you to:

Running the Falcon LogScale Collector from Command Line

Note

Create a valid configuration before running the Log Collector, see Configure Falcon LogScale Collector for more information.

You can manually run Falcon LogScale Collector on macOS, this procedure is required if you do not want to enroll your Log Collector in Manage Your Fleet.

shell
$ logscale-collector -cfg /usr/local/etc/logscale-collector/config.yaml
Running Falcon LogScale Collector as a LaunchDeamon (service)

Note

Create a valid configuration before running the Log Collector, see Configure Falcon LogScale Collector for more information.

You can run the following command to automatically starts the Falcon LogScale Collector as LaunchDaemon (background service).

shell
$ sudo launchctl bootstrap system /Library/LaunchDaemons/com.crowdstrike.logscale-collector.plist

if you need to stop Falcon LogScale Collector and disable the service run the following:

shell
$ sudo launchctl bootout system/com.crowdstrike.logscale-collector