Install Falcon LogScale Collector

Step 1 - Create a LogScale Collector ingest token

Why? Installation places the Collector executable and supporting files on the host. The workflow depends on the deployment model.

Windows installation options:

Falcon LogScale Collector can be installed on Windows using different deployment models. These different methods of deployment result in the Collector being installed in different locations, and with different filenames:

Installation type	Default executable path
Sensor managed	`C:\Program Files\LogScale Collector Sensor Managed\logscale-collector.exe`
Custom Install	`C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe`
Full Install	`C:\Program Files\LogScale Collector\Logscale Collector.exe`

Option A - Full Install

Use CrowdStrike's Full Falcon LogScale Collector Installation workflow where available. CrowdStrike recommends this method because it supports Fleet version management and automatic enrollment in Fleet Management.

After installation, the default Windows executable path is:

C:\Program Files\LogScale Collector\Logscale Collector.exe

Verify that the Collector is installed and running before continuing to the source and sink configuration. Use the Troubleshooting documentation for supported verification commands.

Option B - Custom Install

Use Custom Install when you need to install and configure the Collector manually. Download the platform-appropriate Collector package and follow the Custom Falcon LogScale Collector Installation procedure

On Windows, the default Custom Install executable path is:

C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe

The legacy Humio naming in this path is expected for this installation type.

Option C - Sensor-managed Windows installation

For Sensor-managed deployments on Windows, the default executable path is:

C:\Program Files\LogScale Collector Sensor Managed\logscale-collector.exe

Linux installation

CrowdStrike provides a Custom Install package for supported Linux systems. Follow the current Install Falcon LogScale Collector on Linux - Custom Install procedure to get started.

macOS installation

CrowdStrike provides a Custom Install package for supported macOS systems. Follow the current Install Falcon LogScale Collector on macOS - Custom Install procedure to get started.

Kubernetes with Helm

For Kubernetes application/container logs, deploy Falcon LogScale Collector using the CrowdStrike Falcon LogScale Collector Helm Chart Helm chart.

Step 2 - Configure a source

Why? A source defines where the Collector obtains events. Each source type has its own required and optional settings.

Use the Popular Ingest Methods for detailed configuration options.

Step 3 - Configure transforms when required

Transforms are optional and can modify, enrich, filter, or route events between sources and sinks. Configure only the transforms required for the deployment. The Kubernetes Helm workflow applies Kubernetes-specific processing/enrichment to container events.

Step 4 - Configure the destination sink

Why? A sink defines where the Collector sends processed events.

For Falcon LogScale Collector, configure a Humio/LogScale sink with the destination URL and ingest token. Here's an example:

yaml

{
sinks:
  logscale:
    type: humio
    token: "${INGEST_TOKEN}"
    url: "https://<your-logscale-cluster>"
}

Use the URL appropriate for your deployment and protect ingest tokens and other credentials as necessary. Fleet-managed deployments can centralize configuration instead of relying solely on a local YAML file.

Step 5 - Validate and start the Collector

Save or deploy the Collector configuration.
Use the Collector configuration-validation capability to identify invalid or unsupported configuration.
Start or restart the Collector as required. See below for reference commands.
Confirm that the Collector service/process is running.
Review Collector logs for source, transform, sink, authentication, TLS, or connectivity errors.

Reference commands:

To start the Collector service:

For Linux (systemd):

sudo systemctl start logscale-collector
sudo systemctl enable logscale-collector  # Enable auto-start on boot

For Linux (init.d):

sudo service logscale-collector start
sudo chkconfig logscale-collector on  # Enable auto-start on boot

For Windows:

net start "LogScale Collector"
# Or use Services management console (services.msc)

For Docker:
```
docker start logscale-collector
```

For Kubernetes:

# DaemonSet starts automatically after deployment
kubectl rollout status daemonset/logscale-collector -n logging

To verify the Collector is running:

For Linux:

sudo systemctl status logscale-collector
# Check for "active (running)" status

For Windows:

sc query "LogScale Collector"
# Check for "RUNNING" state

For Docker:

docker ps | grep logscale-collector
docker logs logscale-collector

For Kubernetes:

kubectl get pods -n logging -l app=logscale-collector
kubectl logs -n logging -l app=logscale-collector

Step 6 - Verify ingestion

Generate or identify a representative event at the configured source.
Search the Falcon LogScale Collector destination for the event.
Verify that the expected parser and fields are applied.
If the event is missing, check the Collector logs, source configuration, network connectivity, sink configuration, ingest token, and destination URL.

You can verify that data is being ingested in the following ways:

Check Collector logs for startup messages:
- Look for successful configuration loading
- Verify connection to LogScale endpoint
- Confirm input sources are initialized
- Check for any error or warning messages
Verify log file monitoring:
- Check Collector logs for file discovery messages
- Verify the Collector has opened configured log files
- Confirm file positions are being tracked

Generate test log entries:

Write test entries to monitored log files:

echo "Test log entry $(date)" >> /var/log/app/test.log

For Windows Event Logs, generate test events using PowerShell:

Write-EventLog -LogName Application -Source "TestApp" -EventId 1000 -Message "Test event"

Verify data in LogScale:
- Navigate to your repository in LogScale
- Run a query to find recently ingested events from the Collector:
  #type=collector OR @collector=*
- Verify events have correct timestamps
- Confirm fields are extracted correctly according to the parser
- Check that custom tags and fields are present
- Verify host metadata is included (hostname, IP address)
Check Collector metrics (if enabled):
- Access the metrics endpoint:
  curl http://localhost:9090/metrics
- Review key metrics:
  - events_read_total: Total events read from sources
  - events_sent_total: Total events sent to LogScale
  - events_failed_total: Failed event transmissions
  - buffer_size_bytes: Current buffer utilization
  - files_active: Number of actively monitored files
Verify continuous operation:
- Monitor for several minutes to ensure stable operation
- Check that events continue to flow to LogScale
- Verify no error accumulation in Collector logs
- Confirm resource usage (CPU, memory) is within acceptable limits
Test error handling and recovery:
- Temporarily block network access to LogScale endpoint
- Verify the Collector buffers events locally
- Restore network access and confirm buffered events are sent
- Verify no data loss occurred during the outage
Test Collector restart behavior:
- Restart the Collector service
- Verify it resumes from the last processed position (no duplicate events)
- Confirm state files are being used correctly

Deploy Falcon LogScale Collector in Kubernetes

Use this workflow when the goal is to collect Kubernetes application/container logs.

Create the ingest-token:

shell

Secret kubectl create secret generic logscale-collector-token --from-literal=ingestToken="YOUR INGEST TOKEN HERE"

Create the Secret in the same namespace as the Helm release.

Create a Helm values file:

shell

humioAddress https://<your-logscale-cluster>
humioIngestTokenSecretName: logscale-collector-token

Add the CrowdStrike Helm repository:

shell

helm repo add logscale-collector-helm https://registry.crowdstrike.com/log-collector-us1-prod

Install the chart

shell

helm install my-install-name logscale-collector-helm/logscale-collector --values logscale-collector.yaml

Understand the default container-log source:
The Helm chart enables a container file source by default. The generated Collector configuration reads Kubernetes container logs from /var/log/containers/*.log and applies Kubernetes processing/enrichment. The chart excludes the Collector's own container log from the default source.
Verify Kubernetes ingestion:
1. Confirm that the Helm release and Collector pods are healthy.
2. Review the Collector pod logs for errors.
3. Generate or identify an application log from a pod.
4. Confirm the event reaches the target repository.
5. Verify the expected Kubernetes metadata.

Versions of this Page

Getting Data In

How is Data Impacted?

How to Get Data in

Manage Data Ingest

Package Marketplace

Package Reference

Dashboard Reference

Package Management

Other Integrations

Log Formats

Install Falcon LogScale Collector

Enter search term