Best Practice: Contacting Support

You can submit a support ticket via the Support portal or you can send an email to <logscalesupport@crowdstrike.com>.

Note

Support is not able to provide in-depth troubleshooting for 3rd party services including advanced log forwarding configurations and configuring non-LogScale-hosted Kafka., Please see our Statement of Support for more details.

Submitting your Ticket - Troubleshooting Information to Expedite Issue Resolution

If you have a CSM for your organization, always copy them on all communications
For all support cases, please provide:
- The expected behavior
- The observed behavior - a detailed description of the symptom
- The user (username) that is experiencing symptom if applicable
- Screenshots showing the URL and full web browser

LogScale Query (Search) Issues

For LogScale query issues, please provide:
- Explicit written approval for the LogScale team to access the repo or view for troubleshooting purposes
- A link to the literal query (copy and paste the search URL from the browser).

Collector Issues

Include the collector version
Include the host OS where the LogScale collector is installed
Include the config file
- See Downloading and Installing LogScale Collector Using Curl Commands(Full Install) for file locations and more information on LogScale collectors on Windows
- See Downloading and Installing LogScale Collector Using Curl Commands(Full Install) for file locations and more information on LogScale collectors on Linux
Include the debug output (--log-level debug)

Hosted (SaaS) LogScale

If this is a Cloud environment and you would like Support to have access to your repository for troubleshooting, provide explicit permission in the ticket.

Self Hosted (on premise) LogScale

LogScale recommends to ship self-hosted cluster debug logs to the LogScale cloud for real time troubleshooting and reducing support issue resolution times, instructions for how to do this are:
If LogScale is crashing, provide the /data/logs/humio-debug-# log from each LogScale node that has reported an error.
Provide a copy of the LogScale configuration
- The LogScale conf file is usually called server.conf and it's located the /etc/humio directory
Provide logs from connected services if relevant (SMTP logs for issues with emails, LDAP logs for issues with logging in, etc.).
Provide information of any changes made at the time the issue occurred; for example updates to LogScale or the environment in general (OS updates, etc.).

Ticket Priorities

The priority levels we support are defined as follows:

P1 - Urgent
Impact: The product/service is entirely inaccessible, or unable to perform core functions for normal use.
- Must be a production system.
- A Support contact must be available on the customer side to troubleshoot the issue. If a contact is not available, the ticket will be downgraded to a P2.
P2 - High
Impact: The product is operational but one or more important functions is unavailable.
P3 - Normal
Impact: Part of the product is not working; a workaround is available.

For response times, read the CrowdStrike Service Level Agreement.

Important

When you open a case by sending an email to logscalesupport@crowstrike.com, the priority is set to P3 by default.

For high priority issues, the case should be set as P2 or P1, according to the following procedures:

If your case is a P2, please ask the Support agent to raise the priority when you open it.
If your case is a P1 where you need a more urgent help, please call the CrowdStrike Customer Support numbers .

Submitting Feature Requests

For feature requests and enhancements please provide us with the following information so we can narrow down the request quickly and move the process along for you: