Falcon LogScale Collector

The Falcon LogScale Collector is the native Falcon LogScale Collector which can be used to collect and send events to a LogScale repository. The LogScale Collector uses LogScale ingest tokens to route data to the relevant repositories.

The current version of Falcon LogScale Collector:

  • Is available on Linux and Windows

  • Offers Fleet Management which allows you to centerally manage multiple instances of LogScale Collector

  • Collects from the following sources:

    • Command Sources

    • Windows Event Sources

    • File Sources

    • Linux Sources

    • Syslog Sources

    • JournalD Sources

  • @collect.* metadata attached to the events including unique collector ID, hostname, @collect.timestamp etc

  • Buffers in memory

  • Sends data to LogScale instance based on ingest token or environment variable

  • Offers a sub-second ingest lag between a line being written and sent to LogScale (configurable)

  • Offers network compression which defaults to ON

  • Supports HTTP(S) proxies.

Refer to the following documentation for more information on the LogScale Collector:

See the following sections for more information on: