Install Falcon Log Collector on macOS - Custom

This procedure describes how to perform a custom installation of the Falcon Log Collector on a macOS.

  1. Download the Falcon Log Collector as described in Download Falcon Log Collector - Custom or using the command-line, see Download Installers from the Command-line.

  2. Double click the installer.

  3. You can use the following command to run and enroll your Log Collector in Manage Your Fleet and specify the enrollment token.

    Note

    Create a valid configuration before running the LogScale Collector, see Configure Falcon Log Collector for more information.

    shell
    $ sudo logscale-collector enroll enrolltoken

    If you want to manage your configuration manually you must follow the steps described in, Running Falcon Log Collector Manually on macOS

    Note

    Errors and warnings are logged to /var/log/logscale-collector/main.log

Running Falcon Log Collector Manually on macOS

The following procedures describe how to perform a set of optional manual steps, which allow you to:

Running the Falcon Log Collector from Command Line

Note

Create a valid configuration before running the LogScale Collector, see Configure Falcon Log Collector for more information.

You can manually run Falcon Log Collector on macOS, this procedure is required if you do not want to enroll your LogScale Collector in Manage Your Fleet.

shell
$ logscale-collector -cfg /usr/local/etc/logscale-collector/config.yaml
Running Falcon Log Collector as a LaunchDeamon (service)

Note

Create a valid configuration before running the LogScale Collector, see Configure Falcon Log Collector for more information.

You can run the following command to automatically starts the Falcon Log Collector as LaunchDaemon (background service).

shell
$ sudo launchctl bootstrap system /Library/LaunchDaemons/com.crowdstrike.logscale-collector.plist

if you need to stop Falcon Log Collector and disable the service run the following:

shell
$ sudo launchctl bootout system/com.crowdstrike.logscale-collector