Best Practice: Contacting Support

To help you resolve LogScale issues, the primary point of contact where to submit tickets is the CrowdStrike Customer Center support portal.

If the portal can't be accessed for any reason, requests for support can be sent by email at <logscalesupport@crowdstrike.com>.

Note

LogScale Support Team is not able to provide in-depth troubleshooting for 3rd party services including advanced log forwarding configurations and configuring non-LogScale-hosted Kafka. Please see our Statement of Support for more details.

Important

When you open a case by sending an email to logscalesupport@crowstrike.com, the priority is set to P3 by default.

For high priority issues, the case should be set as P2 or P1, according to the following procedures:

  • If your case is a P2, please ask the Support agent to raise the priority when you open it.

  • If your case is a P1 where you need a more urgent help, please call the CrowdStrike Customer Support numbers .

Ticket Priorities

The priority levels we support are defined as follows:

  • P1 – Urgent

    Impact: The product/service is entirely inaccessible, or unable to perform core functions for normal use.

    • Must be a production system.

    • A Support contact must be available on the customer side to troubleshoot the issue. If a contact is not available, the ticket will be downgraded to a P2.

  • P2 – High

    Impact: The product is operational but one or more important functions is unavailable.

  • P3 – Normal

    Impact: Part of the product is not working; a workaround is available.

For response times, read the CrowdStrike Service Level Agreement.

Submitting your Ticket – Troubleshooting Information to Expedite Issue Resolution

  • If you have a CSM for your organization, always copy them on all communications

  • For all support cases, please provide:

    • The expected behavior

    • The observed behavior — a detailed description of the symptom

    • The user (username) who is experiencing the symptom if applicable

    • Screenshots showing the URL and full web browser

LogScale Query (Search) Issues

  • For LogScale query issues, please provide:

    • Explicit written approval for the LogScale team to access the repository or view for troubleshooting purposes

    • A link to the literal query (copy and paste the search URL from the browser).

LogScale Collector Issues

  • Include the LogScale Collector version

  • Include the host OS where the LogScale Collector is installed

  • Include the configuration file

  • Include the debug output (--log-level debug)

Hosted (SaaS) LogScale

  • If this is a Cloud environment and you would like Support to have access to your repository for troubleshooting, provide explicit permission in the ticket.

Self-Hosted (on premise) LogScale

  • LogScale recommends to ship self-hosted cluster debug logs to the LogScale cloud for real time troubleshooting and reducing support issue resolution times, instructions for how to do this are:

  • If LogScale is crashing, provide the /data/logs/humio-debug-* log from each LogScale node that has reported an error.

  • Provide a copy of the LogScale configuration

    • The LogScale configuration file is usually called server.conf and it's located in the /etc/humio directory

  • Provide logs from connected services if relevant (SMTP logs for issues with emails, LDAP logs for issues with logging in, etc.).

  • Provide information of any changes made at the time the issue occurred; for example, updates to LogScale or the environment in general (OS updates, etc.).

Submitting Feature Requests

For feature requests and enhancements please provide the Support Team with the following information in order to accelerate the process:

  • The current version of LogScale that does not have the feature being requested.

  • A screen capture or a recording of the behavior if applicable.

  • Whether the requested feature is applicable for clustered or standalone environments.

  • Where in LogScale UI you expect the feature to be.

  • How you expect the new feature to work (brief description).

  • How important the feature is for your organization, on a scale of 1-10.

Requests for new features can also be submitted to the LogScale Success Team at logscalesuccess@crowdstrike.com.