Best Practice: Contacting Support

You can submit a support ticket via the Support portal or you can send an email to <logscalesupport@crowdstrike.com>.

Note

Support is not able to provide in-depth troubleshooting for 3rd party services including advanced log forwarding configurations and configuring non-LogScale-hosted Kafka., Please see our Statement of Support for more details.

Submitting your Ticket - Troubleshooting Information to Expedite Issue Resolution

  • If you have a CSM for your organization, always copy them on all communications

  • For all support cases, please provide:

    • The expected behavior

    • The observed behavior - a detailed description of the symptom

    • The user (username) that is experiencing symptom if applicable

    • Screenshots showing the URL and full web browser

LogScale Query (Search) Issues

  • For LogScale query issues, please provide:

    • Explicit written approval for the LogScale team to access the repo or view for troubleshooting purposes

    • A link to the literal query (copy and paste the search URL from the browser).

Collector Issues

  • Include the collector version

  • Include the host OS where the LogScale collector is installed

  • Include the config file

  • Include the debug output (--log-level debug)

Hosted (SaaS) LogScale

  • If this is a Cloud environment and you would like Support to have access to your repository for troubleshooting, provide explicit permission in the ticket.

Self Hosted (on premise) LogScale

  • LogScale recommends to ship self-hosted cluster debug logs to the LogScale cloud for real time troubleshooting and reducing support issue resolution times, instructions for how to do this are:

  • If LogScale is crashing, provide the /data/logs/humio-debug-# log from each LogScale node that has reported an error.

  • Provide a copy of the LogScale configuration

    • The LogScale conf file is usually called server.conf and it's located the /etc/humio directory

  • Provide logs from connected services if relevant (SMTP logs for issues with emails, LDAP logs for issues with logging in, etc.).

  • Provide information of any changes made at the time the issue occurred; for example updates to LogScale or the environment in general (OS updates, etc.).

Ticket Priorities

The priority levels we support are defined as follows:

  • P1 - Urgent

    Impact: The product/service is entirely inaccessible, or unable to perform core functions for normal use.

    • Must be a production system.

    • A Support contact must be available on the customer side to troubleshoot the issue. If a contact is not available, the ticket will be downgraded to a P2.

  • P2 - High

    Impact: The product is operational but one or more important functions is unavailable.

  • P3 - Normal

    Impact: Part of the product is not working; a workaround is available.

For response times, read the CrowdStrike Service Level Agreement.

Important

When you open a case by sending an email to logscalesupport@crowstrike.com, the priority is set to P3 by default.

For high priority issues, the case should be set as P2 or P1, according to the following procedures:

  • If your case is a P2, please ask the Support agent to raise the priority when you open it.

  • If your case is a P1 where you need a more urgent help, please call the CrowdStrike Customer Support numbers .

Submitting Feature Requests

For feature requests and enhancements please provide us with the following information so we can narrow down the request quickly and move the process along for you:

  • Current version of LogScale that does not have the feature being requested

  • Is the requested feature applicable for clustered environments or standalone?

  • Where in LogScale UI do you expect the feature to be?

  • Briefly describe how you expect the new feature to work?

  • On a scale of 1-10 how important is the feature for your organization?

  • Provide us with a screen capture or a recording of the behavior if applicable

You may also submit feature requests to our success team at logscalesuccess@crowdstrike.com.