Collector Login
Most collector administration happens in the portal, on Configuration → Collectors (v1: Platform → Administration → Collectors). The console is for the few things the portal cannot do: setting the appliance's own network configuration before it can reach the platform, registering it, and fetching files from it.
Reaching the Console
Log in at the VM's console, or over SSH on port 22, with the operating-system account set up when the appliance was built: the root password chosen during the Rocky Linux installation, or the cloud provider's own account for an image launched in AWS, Azure or GCP. Without root, prefix each command below with sudo.
Management Commands
The mgmt command manages the appliance from its console.
Network
The collector's network settings are the operating system's own, managed by NetworkManager. Find the name of the active connection first (on Rocky Linux it is usually the interface's name, such as ens192):
nmcli -t -f NAME,DEVICE connection show --active
To give the collector a static address, with the network's prefix length (such as /24) rather than a netmask:
nmcli connection modify <connection> ipv4.method manual ipv4.addresses <ip>/<prefix> ipv4.gateway <gateway> ipv4.dns "<dns1> <dns2>"
nmcli connection up <connection>
To return it to DHCP:
nmcli connection modify <connection> ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns ""
nmcli connection up <connection>
nmtui makes the same changes from a menu. ip -4 addr show and ip route show the current address and gateway, and mgmt dns info the DNS servers.
Changing the address over SSH ends the session: make the change at the VM's console, or reconnect to the new address. Devices that send syslog to the collector have to be pointed at the new address as well.
Registration
mgmt add_server registers the collector with your Fluency instance, using the token from the portal:
read -rs FLUENCY_TOKEN
mgmt add_server https://<companyname>.app.ingext.io "$FLUENCY_TOKEN"
See Copy the token and your instance's address for where the token and the host name come from; read -rs keeps the token out of the shell history. Running it again replaces the previous registration. It prints the token it registered in full, so do not run it while sharing your screen or recording, and it then restarts the collector's services. The installer can register a new collector as it installs, with its --server and --token options; mgmt add_server is how to change the registration after that.
Status
mgmt status queue
mgmt syslog info
mgmt status queue lists the collector's queues (UploadService, ScannerInput, IPFilterInput and SummEnginInput) with an overall status, which is NORMAL on a healthy collector, every queue at or near 0. It is the console's view of the Queues section on the portal's Management tab: an UploadService count that keeps growing means the collector cannot upload what it receives.
mgmt syslog info lists the collector's syslog listeners, the ones on its Syslog Ports tab, as JSON.
Files You May Need
| File | What it is |
|---|---|
/etc/certs/ca.crt | The certificate authority the collector generated for itself at install time, which signs the certificate its TLS syslog listeners present. Devices sending to the collector over TLS have to trust this file; the CA downloaded from the platform's Syslog Ports page does not validate a collector. See TLS Trust. |
/data/sdo/config/fsb_config.json | The collector's own name (FSL_name) and its registration: the instance URL and the token. It holds the token in the clear, so treat the file as a credential; change the registration with mgmt add_server. |
/var/log/fluency-install.log | The installer's log, which records the cause when a step of the installation fails. |
After Connecting
Once the collector is registered and its status shows it connected, a green Active badge (v1: a green status dot), configuration moves back to the portal: its syslog listeners, network view and health are on Managing Collectors.