Falcon LogScale Documentation

The LogScale Collector can be downloaded from the LogScale User Interface by authenticated users. To download the LogScale Collector go to Fleet management > LogScale Collector Download.

Figure 287. Download Page

Choose the version of the LogScale Collector you wish to download.

Once the MSI installer is downloaded, execute the installer. The installer will guide you through the installation of the LogScale Collector. It will also create (but not start) a Windows service for the LogScale Collector.

Figure 288. Windows MSI

The default installation path for the LogScale Collector on Windows is: C:\\Program Files (x86)\\CrowdStrike\\Humio Log Collector\\humio-log-collector.exe and the default configuration file config.yaml.

C:\Program Files (x86)\CrowdStrike\Humio Log Collector>humio-log-collector.exe -h
Usage of humio-log-collector.exe:
    --cfg string
     config file
    --log-level string
     specify loglevel to enable debug logging to stderr
    --log-pretty
     print logs to console in a pretty-printed format
    --version
     print version and exit

Enabling LogScale Collector as Windows Service

You can set the LogScale Collector to run automatically at startup. To do so it is necessary to set the service Startup type to be Automatic or Automatic (Delayed Start) depending on the requirements of the collector.

Figure 289. Windows Service

The other service settings should also be reviewed and configured accordingly, including but not limited to the Log On options for running the LogScale Collector as a specific user, and the Recovery options for the desired behavior in the event of failure.

Once you have downloaded and installed Falcon LogScale Collector you need to: