You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/send-data/installed-collectors/configuration.md
+20-18Lines changed: 20 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,14 +4,13 @@ title: Configure an Installed Collector
4
4
description: Learn how to install and configure an Installed Collector to gather data to send to Sumo Logic, and read about deployment options and volume limitations.
5
5
---
6
6
7
-
8
7
import Iframe from 'react-iframe';
9
8
10
-
An Installed Collector is a Java agent that receives logs and metrics from its Sources and then encrypts, compresses, and sends the data to the Sumo service.
9
+
An Installed Collector is a Java agent that receives logs and metrics from its Sources and then encrypts, compresses, and sends the data to the Sumo Logic service.
11
10
12
-
As the name implies, an Installed Collector is installed in your environment, as opposed to a Hosted Collector, which resides on the Sumo service. After installing a Collector, you add Sources, to which the Collector connects to obtain data to send to the Sumo service.
11
+
As the name implies, an Installed Collector is installed in your environment, as opposed to a Hosted Collector, which resides on the Sumo Logic service. After installing a Collector, you add Sources, to which the Collector connects to obtain data to send to the Sumo Logic service.
13
12
14
-
A Sumo Source is an object configured for a specific Collector that sends data to Sumo Logic. There are a number of Source types that work with Installed Collectors. For a list of all Sources supported by Installed Collectors, see [Sources for Installed Collectors](/docs/send-data/installed-collectors/sources).
13
+
A Sumo Logic Source is an object configured for a specific Collector that sends data to Sumo Logic. There are a number of Source types that work with Installed Collectors. For a list of all Sources supported by Installed Collectors, see [Sources for Installed Collectors](/docs/send-data/installed-collectors/sources).
15
14
16
15
See [Choosing a Sumo Logic Collector and Source](/docs/send-data/choose-collector-source) for guidance on when to use a single or multiple Installed Collectors.
17
16
@@ -99,8 +98,7 @@ Generally, as the number of Sources increases, the number of threads also increa
99
98
100
99
## About Collector and Source installation and configuration
101
100
102
-
This section is an overview of the multiple methods Sumo provides for
103
-
installing and configuring Collectors and Sources.
101
+
This section is an overview of the multiple methods Sumo Logic provides for installing and configuring Collectors and Sources.
104
102
105
103
### Collector installation and configuration
106
104
@@ -119,6 +117,10 @@ A few Installed Collector behaviors, such as caching, are configured in the `co
119
117
120
118
You can update the configuration of an Installed Collector using the Collector Management API. For more information, see Collector API Methods and Examples.
121
119
120
+
:::note
121
+
Any collector that has been inactive for 12 months or longer will be automatically deleted. To reuse the same collector, you need to uninstall any remaining services and perform a fresh installation.
122
+
:::
123
+
122
124
### Source configuration
123
125
124
126
You can set up as many as 1,000 Sources on a given Collector. A Source should be configured to collect similar data types. For example, you might set up three Local File Sources to collect router activity logs from three locations, and another Local File Source to collect logs from a web application.
@@ -127,33 +129,33 @@ Each Source is tagged with its own metadata, as described in [Metadata Naming C
127
129
128
130
When you configure Sources that read from log files, you specify a path expression that defines what files to scan. You can optionally configure a denylist of files to exclude from collection.
129
131
130
-
You can create Sources using the Sumo web app at any time after Collector installation. For source-specific instructions, see the topics below [Sources for Installed Collectors](/docs/send-data/installed-collectors/sources).
132
+
You can create Sources using the Sumo Logic web app at any time after Collector installation. For source-specific instructions, see the topics below [Sources for Installed Collectors](/docs/send-data/installed-collectors/sources).
131
133
132
-
Alternatively, you can define Sources for an Installed Collector in a UTF-8 encoded JSON file, in which case you must provide the file when starting the Collector for the first time. For more information, see [Use JSON to Configure Sources](/docs/send-data/use-json-configure-sources). Note that if you provide the Sources configuration in a JSON file, you can no longer manage the Sources through the Sumo web app or the Collector Management API.
134
+
Alternatively, you can define Sources for an Installed Collector in a UTF-8 encoded JSON file, in which case you must provide the file when starting the Collector for the first time. For more information, see [Use JSON to Configure Sources](/docs/send-data/use-json-configure-sources). Note that if you provide the Sources configuration in a JSON file, you can no longer manage the Sources through the Sumo Logic web app or the Collector Management API.
133
135
134
136
## Installed Collectors and Sources in action
135
137
136
138
This section is an overview of how Installed Collectors and their Sources operate.
137
139
138
140
### Installed Collector startup
139
141
140
-
When you start up an Installed Collector for the first time it registers with Sumo and creates any Sources that you have defined in a UTF-8 encoded JSON source configuration file.
142
+
When you start up an Installed Collector for the first time it registers with Sumo Logic and creates any Sources that you have defined in a UTF-8 encoded JSON source configuration file.
141
143
142
-
When the collector tries to register with Sumo it first sends the request to the US1 deployment. If your organization is in another deployment Sumo will redirect the Collector to your deployment URL based on the authentication credential's deployment. You can define the deployment URL in the Collector's [user.properties](collector-installation-reference/user-properties.md) file with the `url` parameter.
144
+
When the collector tries to register with Sumo Logic it first sends the request to the US1 deployment. If your organization is in another deployment Sumo Logic will redirect the Collector to your deployment URL based on the authentication credential's deployment. You can define the deployment URL in the Collector's [user.properties](collector-installation-reference/user-properties.md) file with the `url` parameter.
143
145
144
146
### Sources scan source data
145
147
146
148
Sources scan their target directory or data structure periodically. A Local File Source scans target directories every two seconds. For Windows Performance Monitor Sources and Script Sources, you configure the scan interval when you define the source.
147
149
148
150
For support purposes, an Installed Collector automatically collects its version, uptime, OS version, OS architecture, Java version, and JVM instance ID. Installed Collectors running on AWS also collect instance type, instance ID, and instance region.
149
151
150
-
### How an Installed Collector sends data to the Sumo service
152
+
### How an Installed Collector sends data to the Sumo Logic service
151
153
152
-
An Installed Collector starts sending data to the Sumo service as soon as it is available from the Sources configured on the Collector. Before sending the data, a Collector compresses (by a factor of 10x) and encrypts the data. A Collector sends data to the Sumo service over HTTPS.
154
+
An Installed Collector starts sending data to the Sumo Logic service as soon as it is available from the Sources configured on the Collector. Before sending the data, a Collector compresses (by a factor of 10x) and encrypts the data. A Collector sends data to the Sumo Logic service over HTTPS.
153
155
154
156
#### Fingerprint
155
157
156
-
To keep track of what it has already sent to the Sumo service, the Collector tracks a file by its fingerprint (the first 2048 bytes of the file) and by a read pointer that indicates the last line read by the Collector. This fingerprint is then compared to a list of known fingerprints from that Source. If the fingerprint does not match one in the known list we start reading that file's content from the beginning and send it to Sumo. If a matching fingerprint is found in the list we start reading from the last known byte mark of that file. The Collector updates this information approximately every second. A file's fingerprint is retained for some period of time after file deletion, otherwise it is removed.
158
+
To keep track of what it has already sent to the Sumo Logic service, the Collector tracks a file by its fingerprint (the first 2048 bytes of the file) and by a read pointer that indicates the last line read by the Collector. This fingerprint is then compared to a list of known fingerprints from that Source. If the fingerprint does not match one in the known list we start reading that file's content from the beginning and send it to Sumo Logic. If a matching fingerprint is found in the list we start reading from the last known byte mark of that file. The Collector updates this information approximately every second. A file's fingerprint is retained for some period of time after file deletion, otherwise it is removed.
157
159
158
160
An issue that could arise is seeing duplicated log messages for a log file that is written to very slowly. When a file is slowly written and the first messages in the file are not larger than 2kb the fingerprint for the Source file can be overwritten with each log line, up to the point those first lines add up to 2kb.
159
161
@@ -167,17 +169,17 @@ To resolve these issues, you can adjust the fingerprint size to match your needs
167
169
168
170
### Throttling, caching, and flushing
169
171
170
-
Ordinarily, a Collector sends data to the Sumo service as fast as its connection allows. Under some circumstances, the Sumo service may instruct a Collector to throttle itself or slow the rate at which it is sending data to the service.
172
+
Ordinarily, a Collector sends data to the Sumo Logic service as fast as its connection allows. Under some circumstances, the Sumo Logic service may instruct a Collector to throttle itself or slow the rate at which it is sending data to the service.
171
173
172
-
To determine whether throttling is required, Sumo measures the amount of data already committed to uploading against the number of previous requests and available resources (quota) in an account. In other words, Sumo Logic compares the current ingestion with the rate of ingest using a per minute rate that can be derived from the contracted daily GB/day rate.
174
+
To determine whether throttling is required, Sumo Logic measures the amount of data already committed to uploading against the number of previous requests and available resources (quota) in an account. In other words, Sumo Logic compares the current ingestion with the rate of ingest using a per minute rate that can be derived from the contracted daily GB/day rate.
173
175
174
-
The Sumo service tells the Collector it can speed up when throttling is no longer necessary.
176
+
The Sumo Logic service tells the Collector it can speed up when throttling is no longer necessary.
175
177
176
178
For more information, see Manage Ingestion.
177
179
178
180
#### Caching
179
181
180
-
Installed Collectors cache outbound data when throttled or paused or if the connection to the Sumo service is lost. Data is cached first in memory and then on disk. By default, a Collector supports caching the following amounts:
182
+
Installed Collectors cache outbound data when throttled or paused or if the connection to the Sumo Logic service is lost. Data is cached first in memory and then on disk. By default, a Collector supports caching the following amounts:
181
183
182
184
Up to 4GB total disk space, including:
183
185
@@ -194,7 +196,7 @@ A Collector enters flushing mode when less than 10% of free disk space remains o
194
196
195
197
## Collector monitoring and logging
196
198
197
-
An Installed Collector sends a heartbeat to the Sumo service every 15 seconds. If the Sumo service does not receive a heartbeat for 30 minutes, it considers the Collector to be offline, and shows its health status as red in the **Collection** page of the Sumo web app. The heartbeat is linked to the [`alive` parameter](/docs/send-data/use-json-configure-sources)in the JSON object. If an Installed Collector
199
+
An Installed Collector sends a heartbeat to the Sumo Logic service every 15 seconds. If the Sumo Logic service does not receive a heartbeat for 30 minutes, it considers the Collector to be offline, and shows its health status as red in the **Collection** page of the Sumo Logic web app. The heartbeat is linked to the [`alive` parameter](/docs/send-data/use-json-configure-sources)in the JSON object. If an Installed Collector
198
200
appears offline try restarting the service and [testing connectivity](collector-installation-reference/test-connectivity-sumo-collectors.md).
199
201
200
202
The Collector uses the log4j2 framework. You can tailor log rotation behavior for `collector.log` by editing the `log4j2.xml` file in the collector’s `/config` directory. For more information, see Log Rotation Settings.
0 commit comments