Full Falcon LogScale Collector Installation

The documentation provides step-by-step instructions for downloading and installing the Falcon LogScale Collector using curl commands through a full installation process, which is supported from LogScale version 1.136.0 and above. The guide covers operating system compatibility, installation steps through the LogScale User Interface, and essential post-installation tasks including Linux-specific configurations, ingest token generation, and collector configuration.

Available: Full Install v1.136.0

Full Install is the recommended method of installation and is supported as of LogScale 1.136.0, if you are using a prior version, see Custom Installation for information. This method supports Remote Version Management Manage Versions - Groups and offers full support and enrollment in Fleet Overview.

Before you start the installation procedure see Prerequisities and Sizing for information on sizing and supported operating system for this version of Falcon LogScale Collector.

The following pages detail how to download and install the Log Collector on all the supported operating system using the Full install. Full install provides curl command to install and perform additional post installation configuration based on the operating system selected.

Prerequisites

  1. The Falcon LogScale Collector can be downloaded from the LogScale User Interface by authenticated users. To download the Falcon LogScale Collector go to Data ingest and click Get LogScale Collector.

    Download Page

    Figure 1. Download Page


  2. Select Full install. Manage Versions - Groups centrally can only be used if you use Full install.

  3. Follow the steps on the panel:

    1. Select the radio button for the required Falcon LogScale Collector Installation.

    2. Select an enrollment token from the dropdown menu or leave the default.

    3. Copy, paste and run the curl command in the terminal of your machine to download and install Falcon LogScale Collector.

    4. View your instance on Fleet Overview page.

  4. You can now configure your Falcon LogScale Collector, for more information see Configuration.

To access this same information from the command-line or through custom programs, use the GraphQL API. You can use the defaultFleetInstallationToken() query to get the default Fleet installation token for your operating system, along with the commands to execute.

Full Installation Options

This feature is available as of 1.10.2, when using the full installation command, it's possible to configure parts of the installation via command line options. To add command line options to the installation command, use the following methods:

How to Use Options
Windows/Powershell

For Windows/Powershell, append the options directly to the end of the command: 

& ([scriptblock]::Create((Invoke-RestMethod https://.../api/v1/log-collector/install-collector.ps1 -Method POST -Body "..."))) -Option1 "Value1" -Option2 "Value2"
Linux/macOS

For Linux/macOS, append the following to the sudo bash part, before appending the options: 

-s --

For example: 

... | sudo bash -s -- --Option1 "Value1" --Option2 "Value2"

Without -s -- options will not be passed onto the script.

Options

The following options can be used to configure the installation.

Table: Options

Option Description Option Name Windows Option Name Linux macOS
Set Proxy server

Sets a proxy server that is used by the installer, the update service and the LogScale Collector. The proxy server should be specified using http:// syntax.

If necessary, remember to add a proxy option to the curl command (-x http://...) or Invoke-RestMethod commandlet (-Proxy http://...).

-Proxy --proxy
Set Installation Directory Prefix Overrides the default installation location and instead installs everything under the <prefix>/logscale-collector. -InstallDirPrefix --install-dir-prefix
Set Data Directory Prefix

Overrides the default data directory location and instead stores checkpoints and fleet management token in <prefix>/logscale-collector.

-DataDirPrefix --data-dir-prefix
Enable Capabilities (Linux) Enables AmbientCapabilities DAC_READ_SEARCH and NET_BIND_SERVICE for the LogScale Collector service, granting it read access to any file and the ability to listen on ports <1024. N/A --enable-capabilities

Additional Steps on Linux

When the Falcon LogScale Collector (FLC) is configured to read from files, the humio-log-collector service/user needs read access to those files. By default, this user likely does not have access to a majority of log files in the /var/log directory. The sections below describe how to verify current access, and how to grant the appropriate permissions.

Verifying Read Access

Before making permission changes, it's worth checking what access the humio-log-collector user currently has.

  1. Check folder-level permissions by running:

    shell
    ls -dl <folder to check>

    For example, the /var/log directory typically shows r-x as the last permission set, meaning any user can read/execute at the directory level.

  2. Check file-level permissions within the directory:

    shell
    ls -al /var/log/*.log

    When reviewing the output, there are three categories of files to be aware of:

    • Readable (no changes needed): Files where the "other" permission set includes r. These can already be read by humio-log-collector.

    • Readable via group membership (adm group): Files owned by the adm group where the group permission set shows r--. These can be made readable by adding humio-log-collector to the adm group (see next section).

    • Not readable by default (root-only): Files where permissions show rw-------. These cannot be read without either changing file permissions or adding them to a group that humio-log-collector belongs to.

Identifying Permission Errors at Runtime

If FLC is started in debug mode and encounters files it cannot read, you will see errors similar to these:

shell
ERR go.crwd.dev/lc/log-collector/internal/sources/files/files.go:386 > Could not identify file. 
error="open /var/log/vmware-vmsvc-root.1.log: permission denied" 
path=/var/log/vmware-vmsvc-root.1.log

These permission denied errors confirm that the humio-log-collector user lacks read access to those specific files.

Granting File Permissions

Option 1: Add the Collector User to the adm Group

This is the recommended approach for granting access to log files owned by the adm group (such as auth.log, kern.log, or cloud-init.log). Adding humio-log-collector to the adm group grants read access to any file where the group permission includes r.

shell
$ sudo usermod -a -G adm humio-log-collector

Note

This will not grant access to files that are root-only (i.e., no group or "other" read permissions). For those files, see Option 2 or consider adjusting individual file permissions manually.

Option 2: Allow Access to all files on the Filesystem

The following capability can be added to the FLC process to grant read access to all files on the filesystem, regardless of their permissions.

Important

This provides broad access to all system files and is not recommended for anything other than testing purposes.

  1. Open an editor to create a systemd override file:

    shell
    $ sudo systemctl edit humio-log-collector.service

  2. Add the following lines in the editor:

    shell
    [Service] 
AmbientCapabilities=CAP_DAC_READ_SEARCH

  3. Save and close the editor. This creates an override file in /etc/systemd/system/humio-log-collector.service.d/ without modifying the original service file.

  4. Reload the systemd manager configuration:

    shell
    sudo systemctl daemon-reload

  5. Restart the service to apply the changes:

    shell
    $ sudo systemctl restart humio-log-collector.service