Managing Collectors

Collector Syslog configuration

The platform's own syslog listener protocols are managed separately, on Syslog Ports.

The Collectors page itself, control by control, is documented in the interface reference at Configuration → Collectors (v1: Platform → Administration → Collectors). This page covers which route to take and what the settings mean.

Adding a Collector

There are three ways a collector reaches the Collectors page, and they are not equivalent:

Route	When to use it
Install the Fluency Collector template	The normal path for a new collector. Takes no parameters, and its application details provide the Security token the appliance registers with: see Fluency Collector.
Install the Import collector template	Brings an existing collector under an application, so it is connected to the pipeline like any other. Its single parameter is Collector Name.
Add Collector on the Collectors page	The manual route described below. The dialog itself warns that a collector added this way bypasses the application and is not automatically connected to the data pipeline.

v2 interface

Both templates live under System Components in the Application Catalog: in the navigation rail, open Applications and click Install Application. The Import collector form adds a Configuration section with its one field, Collector Name.

The Collectors page. Configuration → Collectors carries Refresh and Add Collector in its header, and lists the account's collectors in a table with Name, Description, Status, Token, and Actions columns. Status is a badge: a grey No Connection until the appliance first checks in, a green Active while it keeps checking in, then Inactive with the time since it last did (such as Inactive 3 hours ago) once it has been silent for more than ten minutes, and Disconnected after a day; see Status. Token is the collector's unique token, followed by a copy button.

Add Collector opens a dialog with two fields, Name (required) and Description, above a warning in red text: a collector provisioned from this page is added without its application, is not automatically connected to the main data pipeline, and needs further configuration. The confirm button is labelled Save and bypass application; Cancel or × closes the dialog.

The Actions column holds Configure, which opens the collector's configuration and is offered only for an Active collector, and a red Delete, which removes the collector after a confirmation that names it. Every source behind a collector stops with it, so repoint the devices that send to it, and reinstall any LDAP Connector that names it, before deleting one; the confirmation names only the collector itself.

Classic v1 interface

Both templates live under System Components in Platform → Applications → Install Application From Template:

The Collectors page. Platform → Administration → Collectors carries the Add Collector button in its header, and lists the registered collectors in a table with Name, Description, Status, Token, and Actions columns. Status is an indicator dot: green once the appliance is connected and reporting, grey until it checks in; Token is the collector's unique token.

Add Collector opens a dialog with two fields (Name and Description) above a warning in red text: a collector provisioned from this page is added without an application, is not automatically connected to the main data pipeline, and requires further configuration. The confirm button is labelled Save and bypass application; Cancel closes the dialog.

The Actions column holds two buttons: a blue gear that opens the collector's configuration, and a red trash. Clicking the trash opens the Delete Collector confirmation, which asks Are you sure you want to delete this collector followed by the collector's name; Yes deletes it, No keeps it. Every source behind a collector stops with it, so repoint the devices that send to it, and reinstall any LDAP Connector that names it, before deleting one; the confirmation names only the collector itself.

Collector configuration

Event import on the collector side is configured per collector. Once the appliance is connected to the platform, open its settings from the Collectors page:

v2 interface

On Configuration → Collectors, click Configure in that row's Actions column. This opens Collector Configuration, with a Back to Collectors link, the line Collector name: followed by the collector's name, a Refresh button, and three tabs: Syslog Ports, Network Settings and Management.

Classic v1 interface

On Platform → Administration → Collectors, click the blue gear button in that row's Actions column. This opens Collector Configuration, headed by Collector name: and the collector's name, with three tabs: Syslog Ports, Network Settings and Management.

Syslog ports

The tab the configuration opens on. It lists the syslog listeners running on the collector appliance, with IP, Protocol, Port, Description and Actions columns.

v2 interface

Classic v1 interface

A new collector has two listeners, both bound to 0.0.0.0 and described as default syslog port:

Protocol	Port
udp	514
tcp	514

It has no TLS listener until you add one, and a listener on any port other than 514 also needs its port opened in the collector's firewall. The usual ports are 6514 for tls, the standard port for syslog over TLS, and 7514 for tls (RFC6587).

The tab lists the listeners the collector has, so check it before pointing a device at the collector, and add the listener the device needs if it is not there.

To add a listener, click Add Syslog Port and fill in the Add Syslog Port Configuration dialog:

v2 interface

Classic v1 interface

• IP: which address to bind to, defaulting to 0.0.0.0 (all interfaces).
• Protocol: the listener protocol, defaulting to udp.
• Port: the listening port, prefilled with 514.
• Description: free text identifying the listener.
• Customer Tag: an optional tag applied to records arriving on this port, used to attribute them to a customer.

Click Save to create it; the notice Syslog port saved successfully confirms it. Repeat for each additional listener.

Opening the port in the collector's firewall

Adding a listener does not open its port in the collector's host firewall. The firewall the installer sets up admits syslog on port 514 only (see What the installer changes on the system), so a listener on any other port, a TLS listener included, refuses connections from other machines (No route to host) until you open the port on the collector's console. The rule set ends by rejecting everything it has not admitted, so insert the new rule (-I) rather than appending it, then save the rules so that they survive a reboot:

iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 6514 -j ACCEPT
iptables-save > /etc/sysconfig/iptables

Use the listener's own port, and -p udp -m udp in place of -p tcp -m tcp for a udp listener. To check from another machine on the network that a TLS listener answers, run openssl s_client -connect <collector-ip>:6514 </dev/null: it should print the collector's certificate chain.

A listener's red Delete (v1: red trash button) removes it, after a confirmation that names the protocol and port being removed. Remove its firewall rule too: the same iptables command with -D in place of -I, then save again.

These are the syslog listener ports on the collector appliance. For the platform-side syslog endpoint, see Syslog Ports.

Supported Protocols

Protocol	Encrypted	Framing	Notes
udp	No	One message per datagram	Best effort: lost datagrams are not reported. For devices on the same trusted network that can do nothing better.
tcp	No	One message per line	Reliable while connected.
tls	Yes	One message per line	What most devices call syslog over TLS.
tls (RFC6587)	Yes	Octet-counted: each message prefixed with its length	For devices whose reliable mode sends length-prefixed messages, such as FortiGate.

The two TLS listeners are different framings, and a device on the wrong one fails quietly; see Choosing a Protocol. Both present a certificate signed by the collector's own certificate authority, which senders have to trust; it is /etc/certs/ca.crt on the appliance, not the CA file from the platform's Syslog Ports page. See TLS Trust.

Which message format a device should send is decided by its template's parser, not by the collector; each device guide in Integrations names it.

Network settings

A read-only view of the appliance's network configuration: a table of interfaces with IP Address, Netmask and NIC, and beneath it the Default IP Gateway and Default Gateway NIC. Use it to confirm the address senders should point at.

v2 interface

Classic v1 interface

Management

The appliance's health and diagnostics, and the first place to look when a collector stops delivering data.

v2 interface

The tab stacks read-only sections covering System Time (including whether the clock is synchronized and NTP is active), with a Refresh Status button, a tail of the appliance's System Logs, CPU Info, Disk Info, Memory Info and Process Info, the Queues depth for the Upload Service and Netflow Input, and the installed RPM version of each collector component. A line beneath the Restart Collector button reports uptime.

Classic v1 interface

The tab stacks read-only panels covering System Time (including whether the clock is synchronized and NTP is active), a tail of the appliance's System Logs with a green refresh button, CPU, Disk, Memory and Process Info, the Queues depth for the upload and netflow inputs, and the installed RPM version of each collector component. A footer reports uptime.

Two checks are worth knowing:

• Queues should sit at zero. A rising Upload Service count means the collector is receiving data but cannot ship it to the platform. On the collector's console, mgmt status queue shows the same queues; see Collector Login → Status.
• System Time should show the clock synchronized and NTP active. An unsynchronized collector clock is a common cause of records arriving with wrong timestamps; see Time Adjustment.

The red Restart Collector button at the bottom restarts the collector's services after a confirmation. Data arriving during the restart is not received, so prefer a maintenance window.

v2 interface

The confirmation asks Are you sure you want to restart the collector?

Classic v1 interface

Demo

An interactive demo of adding a collector is available here: Adding a Collector (Storylane)