Fluency Collector

The Fluency Collector is a virtual machine that acts as a collection point on your own network. It receives events from local sources (syslog, and NetFlow once it is turned on) and continuously compresses and uploads them to your Fluency instance over HTTPS. It also runs the queries that only work from inside the network, such as LDAP directory synchronisation.

Use one for sources that cannot send securely across the internet, that have no route to it, or that are numerous enough to be worth aggregating at one point. Why Use a Collector covers when a collector earns its place, and when the cloud endpoints are enough on their own.

Network Requirements

Direction	From → to	Port	Purpose
Inbound	Your devices → collector	udp and tcp 514	Syslog. These are the two listeners a new collector has. A TLS listener, such as tls on 6514 or tls (RFC6587) on 7514, is added on the collector's Syslog Ports tab, and its port opened in the collector's firewall; see Managing Collectors → Syslog ports.
Inbound	Your devices → collector	udp 2055	NetFlow. It is off on a new collector: the collector listens on the port but forwards nothing it receives there until NetFlow is turned on. Contact Fluency support to turn it on.
Inbound	Administrators → collector	tcp 22	SSH, for the console; see Collector Login
Outbound	Collector → your Fluency instance	tcp 443	Uploading events over HTTPS. The instance is the same host name you sign in to the web interface at.
Outbound	Collector → package repositories	tcp 443, and 80 for mirrors that use it	Installing and updating: the installation package downloads from fluency-public.s3.us-east-1.amazonaws.com, and the installer installs and updates packages from the Rocky Linux and EPEL repositories.
Outbound	Collector → your directory servers	tcp 389, or as configured	LDAP synchronisation, where an LDAP Connector uses this collector
Outbound	Collector → DNS and NTP servers	udp 53, udp 123	Name resolution, and keeping the clock synchronised

The collector does not need to accept connections from the internet: it reaches the platform by connecting out, so it can sit behind NAT on an ordinary internal network. The installer sets up a host firewall that admits only the collector's own ports; see What the installer changes on the system.

Installation

The Fluency Collector is installed on top of Enterprise Linux operating systems (RHEL variants). Fluency supports Rocky Linux 9 and also AlmaLinux 9.

Installing a collector takes four steps, in this order:

1. Create the collector in the portal, and copy its token and your instance's address. The installer registers the collector with them.
2. Install Rocky Linux 9 on the virtual machine, or launch a Rocky Linux 9 image from your cloud provider.
3. Run the Fluency installation package with your instance's address and the token.
4. Confirm the collector is connected, and that data sent to it arrives.

For more detailed information regarding Rocky Linux, refer to the official vendor documentation:

https://rockylinux.org/about

Create the Collector in the Portal

Two routes, one supported

The normal path is installing a Fluency Collector application from Applications (v1: Platform → Applications), described here. Adding a collector from the Collectors page bypasses the application and leaves the collector unconnected to the pipeline; see Adding a collector from the Collectors page.

Install the Fluency Collector application

v2 interface

In the navigation rail, open Applications and click Install Application, then choose Fluency Collector from the System Components category of the Application Catalog. The form has only the Application section (Instance name and Display name) and no Configuration section: click Install Application.

The Applications page opens with the notice Default is launching. Click the new Fluency Collector row to open its application details. Its Outputs card holds the Security token; that token is what the collector authenticates with.

The Actions card beside it records what the install built: addCollector with the collector's instance name, Add data source with the FluencyCollector-<instance> data source, and Connect data source to router, which connects the SyslogRouter to it. Nothing there needs to be wired by hand.

Classic v1 interface

Go to Platform → Applications → Install Application From Template and choose Fluency Collector from the System Components category. The template takes no parameters; press Install.

Once installed, open the application's details panel with the blue eye button on its card. Under Outputs is a Security token with a copy button at the right of the field; that token is what the collector authenticates with.

The Actions list below the token records what the install built: it added the collector, added a FluencyCollector-default data source, and connected the SyslogRouter to it. Nothing there needs to be wired by hand.

Copy the token and your instance's address

The installer needs two values from the portal.

The collector token.

v2 interface

Open Configuration → Collectors and click the copy button after the collector's token in the Token column. The button turns into a check mark, and a green Copied to clipboard notice appears above the table. The same token is the Security token in the Outputs card of the Fluency Collector application's details.

Classic v1 interface

Take it either from the Token column of the Collectors page (Platform → Administration → Collectors), or from the Fluency Collector application's Security token output, which has a copy button at the right of the field. The portal confirms with a Token Copied to Clipboard! message.

The token authenticates the collector to your instance: treat it as a credential.

Your instance's address. The collector registers with the same host you sign in to the web interface at; there is no separate collector host name. Take it from your browser's address bar while you are signed in, keeping only the scheme and host. For a current standard deployment it has the form https://<companyname>.app.ingext.io, where the first part is the name your instance was given, which is not necessarily your company's name. (The instance is what some people call the site or the tenant.) Older and custom deployments are reached at a different host name (cloud.fluencysecurity.com, cloud.fluencyplatform.com, app.fluencyplatform.com or a regional <region>.fluencyplatform.com), and the rule is the same in every case: use the host you sign in at. See Fluency Web Interface for the URL formats.

The collector's two names. The portal lists the collector under the application's Instance name, on the Collectors page and in the FluencyCollector-<instance> data source. The installer gives the appliance a name of its own, FSL_name, of the form fluency-el9-xxxxxxxx, which the portal does not show. The two need not match: the token is what ties the appliance to the portal's collector.

Install Rocky Linux OS

This section assumes that the Rocky Linux OS installation takes place on a virtual machine with a new, empty disk, and that the system has been booted from the Minimal install ISO. To install it unattended instead, from a kickstart file, see Appendix: Unattended Rocky Linux installation.

NOTE: If your virtual machine already has Rocky Linux pre-installed, such as the case when launching an instance from an AWS, GCP, or MS Azure image, this section may be skipped; follow the instructions in the next Running the Fluency installation package section

The Rocky Linux 9 Minimal install ISO can be found at the following direct link(s):

https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-minimal.iso

https://mirror.cs.vt.edu/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-minimal.iso

(Other official Mirrors/Repositories may be used to download the same ISO.)

The recommended size for the Fluency Collector is 2 vCPU, 8GB RAM and 80GB to 1TB of disk space.

For detailed instructions on Rocky Linux installation, please refer to the official documentation:

https://docs.rockylinux.org/guides/installation/

Booting from ISO image

Start/boot the machine from the installation disk/image. Select the Install Rocky Linux 9 option from the launch menu.

Configuration

On the following screen(s), select the installation language.

Select Continue to proceed to the Installation Summary page.

Localization

Under the LOCALIZATION section, select Time & Date to modify the timezone of the Fluency Collector.

Choose Etc as the Region. Select Greenwich Mean Time as the City.

NOTE: It is strongly suggested to set the Fluency Collector timezone as shown above. Fluency Cloud instances use the UTC timezone, and having both systems on the same timezone settings will simplify data ingress. If that is not possible, the platform corrects whole-hour offsets automatically; see Syslog → Time.

Disk Partitioning

Return to the Installation Summary page, and navigate to the SYSTEM section.

Select Installation Destination to configure disk partitioning.

Manual

Manual Disk Partitioning

NOTE: (Skip this section if using Automatic partitioning.)

Choose the Custom option, for Storage Configuration to proceed.

Select Standard Partition and create a mount point (via the "+" button) for the root directory “/”.

For the Desired Capacity, choose the entire available space.

NOTE: (Advanced Option) For larger Collector deployments, it is also advisable to create a smaller root "/", partition, and allocate the remaining free space to a separate, and larger, "/data" partition. Please reserve a minimum of 10GB for the root partition in this scenario.

Click Done when finished configuring. The File System can use the default xfs setting.

Accept/confirm the changes and acknowledge the warnings to continue.

Automatic

Automatic Disk Partitioning

NOTE: (Alternative Option, skip this section if using Manual partitioning.)

On the following page, choose the Automatic option, for Storage Configuration to proceed.

Click Done when finished configuring.

NOTE: Automatic partitioning may allocate a portion of the free disk space to create a /home partition. This will reduce the available space for data storage, as Fluency does not make use of this directory.

Network Settings

Return to the Installation Summary page, and navigate to the SYSTEM section.

Select Network & Host Name to configure the network settings.

For the Host Name, choose a valid name for the machine, avoiding spaces.

Toggle the On/Off switch for the Network interface to enable the port on boot.

The interface uses DHCP unless you configure it otherwise. Devices send to the collector by its address, so give it one that does not change before you point any at it: either set a static address here, under Configure (the IPv4 Settings tab, method Manual), or reserve the address on your DHCP server.

Advanced options can be found under Configure. Please refer to the OS vendor's documentation for additional instructions.

Click Done when finished.

Additional System Settings

Return to the Installation Summary page, and navigate to the SYSTEM section.

Select KDUMP to configure the KDUMP settings.

It is suggested to disable this feature.

Default User Settings

Return to the Installation Summary page, and navigate to the USER SETTINGS section.

Select Root Password to configure the default root user password.

Select a password for the root user. It is suggested to also Allow root SSH login with password to facilitate initial access and installation. Once the collector is running, set up SSH keys and turn root password login off again.

Begin Installation

Return to the Installation Summary page, and select Begin Installation to start.

Wait for the progress bar to indicate that the installation is complete.

Select Reboot System to complete the installation. You will be prompted to log into the system terminal when the machine completes the reboot.

NOTE: On VMware, install the guest tools once the system is up, so that vSphere reports the collector's address; the minimal ISO does not include them: dnf -y install open-vm-tools, then systemctl enable --now vmtoolsd.

Running the Fluency installation package

Login to the system with the root user credentials created in the above step. If the Rocky Linux installation is from a major cloud service provider, use the vendor provided credentials to log in.

(If not using a root account, add the prefix “sudo” for each of the commands shown below.)

Download Install package

Download the Fluency installation package (and make it executable) via the following commands:

yum -y install wget
wget https://fluency-public.s3.us-east-1.amazonaws.com/installation/Fluency-installer-v924.package
chmod 755 Fluency-installer-v924.package

Execute Install package

Run the package with your instance's address and the collector token from Copy the token and your instance's address, so that it registers the collector as it installs. Read the token into a variable first, so that it stays out of the shell history: read -rs waits, without echoing, for you to paste the token and press Enter.

read -rs FLUENCY_TOKEN
./Fluency-installer-v924.package --server https://<companyname>.app.ingext.io --token "$FLUENCY_TOKEN"

Without --server and --token, the package installs a collector that is not yet registered; register it afterwards as in Registering after the installation.

The installer runs in a single pass: it does not restart the system, and it does not need to be run a second time. It asks two questions, and changes nothing on the system until both are answered. To run it without the questions, from a script or a provisioning tool, see Unattended installation.

First, it asks Do you wish to run this installer? Answer yes.

The installer then verifies the package and checks the kernel version. If it reports the package as corrupt or incomplete, download it again. It installs only on an Enterprise Linux 9 kernel, and stops with an error on any other.

The installation wizard then generates the collector's name (FSL_name), a random name of the form fluency-el9-xxxxxxxx, and asks Do you wish to begin the Fluency Collector installation? Answer yes to install. Answering no offers to run the wizard again or to abort the installation. On a system where the collector is already installed, the wizard reports the existing installation and keeps its name instead. When the installer was given --server and --token, the settings also show the server and the token masked to its last four characters: check that the server is your instance.

The installer extracts the package (installing tar first if the system lacks it) and starts the installation, showing its progress as a bar.

On a fresh Rocky Linux 9 minimal system the installation takes about four minutes. Most of that is the Updating system packages step, which brings the whole system up to date and can run for several minutes without the progress moving: let it finish. The steps after it install admin utilities, configure the system, and install the collector's components: redis, haproxy, nfdump, syslog-ng, fsb_client and mgmt_service.

The console displays DONE when the installation completes, followed by the location of the install log, /var/log/fluency-install.log. The collector services are running at this point.

If the installation updated the kernel or core system libraries, the installer ends with the notice A newer kernel or core system libraries were installed. Reboot when convenient to run them; the collector services start automatically. It never reboots the system itself: the reboot can wait for a maintenance window, and the collector services start again by themselves when the system comes back up.

If a step fails, the installer prints Installation FAILED in: and the names of the failed steps instead, and the install log records the cause. Correct it and run the package again. A re-run keeps the collector name, server registration and syslog TLS certificates that an earlier run created, so devices already sending to the collector keep working.

What the installer changes on the system

The package turns the system it runs on into a collector appliance, and some of what it changes reaches beyond the collector itself. On a host whose packages or firewall are managed centrally, plan for these:

• Package repositories. It adds the EPEL repository (epel, and epel-cisco-openh264 with it).
• System update. It updates every installed package to the latest available, the kernel included, which is why it may end with the reboot notice.
• Firewall. It removes firewalld and installs iptables in its place, with a rule set that accepts new inbound connections only on tcp 22 (SSH), tcp and udp 514 (syslog), udp 2055 (NetFlow) and tcp 80, plus ICMP, loopback traffic and replies to the collector's own connections, and rejects everything else. A syslog listener added later on any other port is not added to these rules: open its port as in Managing Collectors → Opening the port in the collector's firewall. Port 80 is a plain-HTTP receiver for HTTP Event Collector input on the collector, which answers nothing until such an input is configured for it.
• Services. It installs and starts seven services, which start again at every boot: collectorsync_service, fsb_client, mgmt_service, syslog-ng, redis, haproxy and nfdump.
• Certificates. It creates the collector's own certificate authority and server certificate in /etc/certs (ca.crt, ca.key, server.crt, server.key, and the request and serial files that go with them). ca.crt is the file that devices sending to the collector over TLS have to trust; see TLS Trust.

Installer options

The package takes these options on its command line, in an interactive run as well as a headless one:

Option	Effect
--server URL	Registers the collector with your Fluency instance during the installation, as mgmt add_server does afterwards. Needs --token.
--token TOKEN	The collector token to register with. Needs --server.
--headless, -y	Installs without asking any questions, with the generated settings, as if both questions were answered yes.
--help, -h	Lists the options, and exits without installing.

--server and --token also accept the --server=URL and --token=TOKEN forms. If an option is not one of these, or --server and --token cannot be used as given (one without the other, an empty value, an http:// URL, or a value with characters a URL or token cannot contain, such as quotes, $ or spaces), the installer stops with exit status 2, before it changes anything.

Registering during the installation

With --server and --token, the installer registers the collector itself, and there is no mgmt add_server step afterwards. The values are your instance's address and the collector token, from Copy the token and your instance's address.

The installer adds https:// when the URL leaves it out and drops a trailing /, so <companyname>.app.ingext.io works as well. The settings it shows before asking to begin list the server with only the last four characters of the token, and the install log does not record the token.

When the installation finishes, the collector connects to your instance by itself: continue at Confirm the collector is connected.

The options apply only to a new installation. Running the package again on a system where the collector is already installed keeps the existing registration; if the options name a different server or token, the installer says it is ignoring them. To change an installed collector's registration, use mgmt add_server.

Unattended installation

For an automated deployment (a cloud-init script, an image build or a configuration-management run), start the package in headless mode, with the registration options so that the collector needs nothing more once it is installed:

./Fluency-installer-v924.package --headless --server https://<companyname>.app.ingext.io --token "$FLUENCY_TOKEN"

A headless run performs the same installation, and prints the same settings, progress and DONE or Installation FAILED in: result, as an interactive one; when its output goes to a file rather than a terminal, the progress bar becomes one line per step. Its exit status reports the outcome for the tool that started it: 0 when the installation succeeded, 1 when it did not (a failed step, a corrupt package, a system that is not running an Enterprise Linux 9 kernel, or another installer already running on the system), and 2 for options it cannot use.

It still has to run as root, or under sudo. The download and the install together are:

yum -y install wget
wget https://fluency-public.s3.us-east-1.amazonaws.com/installation/Fluency-installer-v924.package
chmod 755 Fluency-installer-v924.package
./Fluency-installer-v924.package --headless --server https://<companyname>.app.ingext.io --token "$FLUENCY_TOKEN"

Take FLUENCY_TOKEN from wherever you keep other credentials, not from the script itself. Without --server and --token, a headless run installs a collector that is not yet registered: register it afterwards as in Registering after the installation.

Registering after the installation

A collector installed without --server and --token is registered with the mgmt add_server command, run on the collector with your instance's address and the collector token from Copy the token and your instance's address. The same command changes an installed collector's registration:

read -rs FLUENCY_TOKEN
mgmt add_server https://<companyname>.app.ingext.io "$FLUENCY_TOKEN"

NOTE: If the Fluency collector has previously been configured for another Fluency Cloud instance, running the above command will overwrite those settings.

Confirm the collector is connected

In the portal

v2 interface

Click Refresh on Configuration → Collectors. The new collector's Status badge should change from a grey No Connection to a green Active, and its Actions column should now offer Configure alongside Delete.

Classic v1 interface

Refresh the Collectors page on the Fluency portal. The Status dot for the new collector should turn from grey to green, and its Actions column should now offer a blue gear alongside the red trash.

On the collector

All seven collector services should report active:

systemctl is-active collectorsync_service fsb_client mgmt_service syslog-ng redis haproxy nfdump

The collector's log names the instance it is registered with, in a line of the form Service name: server URL: https://<companyname>.app.ingext.io RemoteMgm: true:

journalctl -u fsb_client | grep "Service name"

The upload queue should report Status : NORMAL, with UploadService at 0:

mgmt status queue

A queue that keeps growing means the collector is receiving data but cannot upload it. Check that it reaches your instance on tcp 443: ss -tnp state established '( dport = :443 )' lists its connections there, from collectorsync_service and client_service.

Send a test message

From another machine on the same network, send the collector a syslog message over UDP:

logger -n <collector-ip> -P 514 -d "Fluency collector test"

Within a few minutes the message is counted as input on the collector's data source, FluencyCollector-<instance>: open Platform, click that source's card, and look at its Events tab (see Sources → Events). Sending from another machine tests the same path a device takes, the collector's firewall included.

Additional Settings

Configure (v1: the blue gear button) opens Collector Configuration, where the appliance's syslog listeners, network settings and health are managed: see Managing Collectors → Collector configuration, or the Collectors screen reference for the full detail (v1: Collectors). A device that sends over TLS needs a TLS listener, which a new collector does not have: add it on the Syslog Ports tab, and open its port in the collector's firewall, before pointing the device at the collector.

Adding a collector from the Collectors page

A collector added from the Collectors page bypasses the Fluency Collector application, so it is not connected to the data pipeline automatically.

v2 interface

Open Configuration → Collectors. The page lists the account's collectors with Name, Description, Status, Token, and Actions columns, and carries Refresh and Add Collector in its header.

Click Add Collector to open a dialog with two fields, Name (required) and Description, above a warning in red text: a collector provisioned here is added without its application, is not automatically connected to the main data pipeline, and needs further configuration. The confirm button is labelled Save and bypass application.

Classic v1 interface

Navigate to the Collectors page (Platform → Administration → Collectors) on the Fluency portal. The page lists the registered collectors with Name, Description, Status, Token, and Actions columns, and carries the Add Collector button in its header.

Click Add Collector to open a dialog with two fields, Name and Description, above a warning in red text: a collector provisioned here is added without an application, is not automatically connected to the main data pipeline, and requires further configuration. The confirm button is labelled Save and bypass application.

The collector's token then appears in the Token column; give it to the installer as in Execute Install package, or register an installed appliance with it as in Registering after the installation.

Appendix: Unattended Rocky Linux installation

The Rocky Linux installation can run without its screens, from a kickstart file that makes the same choices: UTC, automatic xfs partitioning with no /home, kdump off, DHCP, and a root password that can log in over SSH. The Rocky Linux installer reads the file from a second disc labelled OEMDRV, with no change to the boot menu. On a VM of the recommended size, the installation takes about six minutes from power-on to the login prompt.

It erases every disk

zerombr and clearpart --all erase every disk the installer can see, without asking. On a VM with more than one disk, add ignoredisk --only-use=sda to limit the installation to the system disk (nvme0n1 in place of sda on an NVMe controller).

The kickstart file

Save this as ks.cfg:

ks.cfg

text
cdrom
lang en_US.UTF-8
keyboard us
timezone Etc/UTC --utc
network --bootproto=dhcp --device=link --activate --onboot=on --hostname=collector-01
rootpw --iscrypted <password-hash>
zerombr
clearpart --all --initlabel
autopart --nohome --fstype=xfs
bootloader
firstboot --disable
selinux --enforcing
firewall --enabled --service=ssh
services --enabled=sshd
skipx
reboot

%packages --ignoremissing
@^minimal-environment
open-vm-tools
%end

%addon com_redhat_kdump --disable
%end

%post --log=/root/ks-post.log
# Root may log in over SSH with its password (initial access).
echo 'PermitRootLogin yes' > /etc/ssh/sshd_config.d/01-permitrootlogin.conf
# Show the IPv4 address on the console login screen.
echo 'IPv4 address: \4' >> /etc/issue
echo >> /etc/issue
# VMware Tools reports the IP to ESXi; the minimal ISO may not carry it.
rpm -q open-vm-tools || dnf -y install open-vm-tools || true
systemctl enable vmtoolsd || true
%end

Before using it:

• Replace <password-hash> with a hash of the root password: openssl passwd -6 asks for the password twice and prints the hash.
• Set --hostname= to the collector's host name. --device=link configures the first network interface that has a link.
• The open-vm-tools lines are for VMware. The minimal ISO does not carry the package, so the %post section downloads it, which needs internet access during the installation; without it the step is skipped, and the system works, but vSphere does not show its address. On another hypervisor, remove those lines.
• firewall --enabled --service=ssh applies only until the Fluency installation package runs, which replaces firewalld with its own rules.

For a static address in place of DHCP, replace the network line with one of this form:

network --bootproto=static --ip=192.0.2.50 --netmask=255.255.255.0 --gateway=192.0.2.1 --nameserver=192.0.2.1 --device=link --activate --onboot=on --hostname=collector-01

The OEMDRV disc

Put ks.cfg at the root of an ISO image whose volume label is exactly OEMDRV, for example with xorriso (dnf -y install xorriso on Rocky Linux):

xorriso -as mkisofs -V OEMDRV -J -R -o ks.iso ks.cfg

Installing

1. Attach the Rocky Linux 9 minimal ISO to the VM's first CD/DVD drive and ks.iso to a second, both connected at power-on. In the ESXi host client, add the second drive with Edit settings → Add other device → CD/DVD drive, choose Datastore ISO file, and tick Connect at power on.
2. Power on, and choose Install Rocky Linux 9 from the boot menu, as in Booting from ISO image. The installer finds the kickstart file on the OEMDRV disc and runs without asking anything.
3. At the end of the installation the system reboots, and the console's login screen shows its IPv4 address.
4. Detach both discs. The OEMDRV disc holds the root password hash, and a VM that boots from CD again would start the installation again, erasing its disk.

The kickstart file does not run the Fluency installation package: log in, over SSH or at the console, and continue at Running the Fluency installation package. Once SSH keys are in place, delete /etc/ssh/sshd_config.d/01-permitrootlogin.conf and restart sshd to turn root password login off again.

In this section

• Why Use a Collector: when a local appliance is the right aggregation point, and when it is not.
• Collector Login: reaching the appliance's own console and management commands.
• Managing Collectors: adding, configuring and monitoring collectors from the portal.