Manually Install Falcon LogScale Collector on Windows - Custom

The documentation outlines the custom installation process for the Falcon LogScale Collector on Windows systems, including downloading the installer and executing the Windows MSI package. The installation creates a Windows service and places files in the default location at C:\Program Files (x86)\CrowdStrike\Humio Log Collector, with a standard config.yaml configuration file.

This procedure describes how to perform a custom installation of the Falcon LogScale Collector on Windows.

  1. Download the Falcon LogScale Collector as described in Download Falcon LogScale Collector and Install - Custom or using the command-line, see Download Installers from the Command-line.

  2. Run the installer. The installer guides you through the installation of the Falcon LogScale Collector. It will also create (but not start) a Windows service for the Falcon LogScale Collector.

    Windows installer wizard showing installation progress with CrowdStrike Humio Log Collector setup interface, displaying progress bar and installation status message

    Figure 3. Windows MSI


Confirm that Falcon LogScale Collector is running.

Note

  • The default installation path for the Falcon LogScale Collector on Windows is: C:\Program Files (x86)\CrowdStrike\Humio Log Collector\logscale-collector.exe

  • The default configuration file is config.yaml

You can confirm that the service is running with these commands:

  1. At a command prompt, type:

    shell
    sc query humioLogCollector

    Note: You might need to run these commands in an elevated command prompt.

  2. Confirm that the State shows: 4 RUNNING.

  3. If the State shows something different, take the appropriate action. For example, if the State shows:

    • 2 START PENDING: wait a while to see if the service eventually starts.

    • 1 STOPPED: try to manually start the service:

      shell
      sc start humioLogCollector

Confirm that data is being collected.

When the Falcon LogScale Collector is active, files start being written to the C:\ProgramData\LogScale Collector\ folder.

If the folder is empty, then log data is not being collected. This could be for a number of reasons, including:

  • TLS certificate errors

  • Ingest token rejected

  • Repository not found

  • HTTP/HTTPS mismatch

To help determine the cause of the issue, stop the service and run the Collector interactively:

shell
sc stop HumioLogCollector
cd "C:\Program Files (x86)\CrowdStrike\Humio Log Collector"
humio-log-collector.exe --cfg config.yaml --log-level debug --log-pretty

Leave the window open for a few minutes. The connection or ingestion error is shown, enabling you to identify the problem area and take the appropriate action.

Errors generally appear in red to help identify them. When you have enough data, press CTRL-C to end the program.

Remember to start the Falcon LogScale Collector service when you have identified or resolved the issue:

shell
sc start humioLogCollector