Skip to main content

collector.properties

For Collector versions 19.182-25 and later the collector.properties file can be modified on existing Collectors allowing you to configure its internal processes for specific uses. This file is generated automatically when installing a Collector.

note

Starting with collector 19.170+, the installation directory is secured to users belonging to the sumologic_collector group. Modifying collector.properties may require sudo privileges. For more information, see Enhanced File System Security for Installed Collectors.

Configure collector.properties

  1. Stop the Sumo Logic Collector service.

    • On Windows: net stop sumo-collector
    • On Linux: sudo ./collector stop  
  2. Navigate to the installation directory of an existing Installed Collector and open the collector.properties file in the config directory with a text editor. An example path is: /<sumo_home>/config/collector.properties

  3. Add the parameters you need, see all of the available parameters in the collector.properties parameters table below.

    info

    Keep all of the existing parameters already in the file. If you remove any, the Collector will not be able to restore them and could result in collection issues.

  4. Save the file in the same location. Maintain UTF-8 format.

  5. Start the Sumo Logic Collector service.

    • On Windows: net start sumo-collector
    • On Linux: sudo ./collector start

Default Collector installation location

The default collector installation locations are:

Linux:

  • /opt/SumoCollector/
  • /usr/local/SumoCollector

Windows:

  • C:\Program Files (x86)\Sumo Logic Collector
  • C:\Program Files\Sumo Logic Collector

collector.properties example

The example below has parameters that were automatically added by the Collector based on the configuration of the user.properties file, such as cpuTarget. The collector.properties file is different, only modify parameters found in the parameters table below. If you see another parameter you want to adjust, check user.properties to see if it's an available configuration parameter.

The collector.properties parameter collector.localfile.inputType has been added and set to nonblocking to tell the Collector to use the Windows Rollable path for UNC file paths. That is the only collector.properties parameter in this example.

receiver.url = https://collectors.sumologic.com
windows.remote.jni = true
cpuTarget = -1
json.sync.mode = UI
logIngestStatus = Normal
collector.debug.forceRestart = -1
collector.localfile.inputType = nonblocking

collector.properties parameters

The table below has parameters that you can manage.

info

Do not modify any other parameters found in the collector.properties file, it could result in collection issues.

Collector versions 19.253-26+ support wrapper configuration parameters.

ParameterTypeDescriptionDefault Value
alerts.ttl.minintegerDuration in minutes before deleting alerts stored in the Collector directory.180
aws.metadata.cache.enabledbooleanEnable fetching and caching AWS-specific local metadata.true
aws.metadata.cache.fetch.timeout.msintegerHTTP connection timeout in milliseconds when attempting to fetch AWS-specific local metadata.1000
aws.metadata.cache.urlstringAWS-specific URL to fetch local metadata to cache.http://169.254.169.254/latest/dynamic/instance-identity/document
collector.backoff.max.timeInMillisintegerMaximum backoff duration in milliseconds for Windows Event Log Sources.60000
collector.backoff.min.timeInMillisintegerInitial backoff duration in milliseconds for Windows Event Log Sources.5000
collector.connection.fixCountintegerSpecifies a fixed number of connections to establish when sending data to Sumo Logic. Must be less than or equal to collector.connection.max.-1
collector.connection.maxintegerMaximum number of connections to establish when sending data to Sumo Logic.3
collector.localfile.inputTypestringOverride for the type of local file reading mechanism. Possible override values include "nonblocking" and "simple".NULL
collector.localFile.oldFileMaxEpsintegerNumber of events per second used to determine how long to sleep when monitoring an old file.500
collector.localFile.oldThresholdMillisintegerDuration in milliseconds after which to move a monitored file to "old" working set.900000
collector.metrics.dumper.millisintegerTime period in milliseconds to log Collector metrics and usage information to collector-usage.log.600000
collector.pipeline.maxMessageCountintegerNumber of messages to accumulate before flushing the log outbound queue.1000
collector.pipeline.maxMessagesSizeintegerSize in bytes to accumulate before flushing the log outbound queue.1048576
collector.pipeline.metrics.maxMessageCountintegerNumber of messages to accumulate before flushing the metrics outbound queue.1000
collector.pipeline.metrics.maxMessagesSizeintegerSize in bytes to accumulate before flushing the metrics outbound queue.1048576
collector.pipeline.metrics.windowSizeMillisintegerTime period in milliseconds to flush the metrics outbound queue.200
collector.pipeline.windowSizeMillisintegerTime period in milliseconds to flush the log outbound queue.1000
collector.registration.delay.msintegerDelay in milliseconds for Collector registration.0
collector.syslog.udp.readBufferSizeintegerMaximum size in bytes to buffer payloads received via UDP with Syslog Sources.2048
collector.wildcard.fpSizeintegerFingerprint size to use (in bytes) when determining new file rotation.2048
collector.wildcard.pathMatcherstringPath expression matcher to use when evaluating file paths.RegexPathExpressionMatcher
collector.winlog.dcom.connectionTimeoutintegerWMI connection timeout in milliseconds for Windows Event Log Sources.60000
collector.winlog.dcom.notificationSessionTimeoutintegerWMI notification session timeout in milliseconds for Windows Event Log Sources.1800000
collector.winlog.dcom.querySessionTimeoutintegerWMI query session timeout in milliseconds for Windows Event Log Sources.30000
collector.winlog.initial.sleep.msintegerDuration in milliseconds to sleep before checking for missed events between catch up and first notification.10000
collector.winlog.maxThreadsintegerMaximum number of threads to use when processing Windows events.16
collector.winlog.queryBatchSizeintegerNumber of elements to fetch during catch up for Windows Event Log Sources.20000
collector.winlog.queryDoCatchupbooleanEnable running catchup queries for Windows Event Log Sources.true
collector.winlog.queryLongWaitTimeintegerDuration in milliseconds to sleep for long queries performed by Windows Event Log Sources.3000
collector.winlog.queryShortWaitTimeintegerDuration in milliseconds to sleep for short queries performed by Windows Event Log Sources.250
collector.winlog.retryConnectionintegerDuration in milliseconds to wait before retrying a failed connection on Windows Event Log Sources.15000
command.fetch.maxRetryintegerMaximum number of times to retry fetching remote commands from Sumo Logic before closing the command channel.15
command.fetch.retryIntervalintegerTime period in milliseconds to retry fetching remote commands from Sumo Logic.5000
docker.apiVersionstringOverride for Docker API version to use when collecting from Docker container sources.NULL
docker.blockProblematicContainerInMsintegerMaximum time in milliseconds to block retry for error-producing Docker container sources.900000
docker.maxContainerErrorPerMinuteintegerMaximum number of error retry attempts per Docker container source.20
docker.maxPerContainerConnectionsintegerMaximum number of Docker container connections to monitor per source.40
forwarding.hcp.dateStamperFormatstringTimestamp format to use when forwarding data to a REST sink source.yyyy-MM-dd
forwarding.http.iso8859booleanEnable forwarding ISO-8859 entities to a REST sink source.false
forwarding.syslog.maxMessageSizeintegerSets the segment size in bytes of forwarded syslog messages.1024
freeSpace.threshold.percentintegerPercentage threshold of free disk space after which the Collector enters flushing mode.10
graphite.hostnamestringOverride the hostname of the syslog server for legacy Graphite sources.NULL
http.connectionTimeoutintegerHTTP connection timeout in milliseconds when attempting to send data to Sumo Logic.60000
http.socketTimeoutintegerHTTP socket timeout in milliseconds when attempting to send data to Sumo Logic.60000
http.transmitter.retry.sleep.msintegerDuration in milliseconds to sleep before retrying sending on connection failure.5000
httpAppender.disablebooleanDisable diagnostic HTTP appender for Collector logging.false
json.sync.sleep.timeintegerTime period in milliseconds to check for changes to the Sources JSON sync file.1000
json.sync.waiting.after.failintegerDuration in milliseconds to wait before retrying to sync to a JSON source sync file after failure.600000
local.win.event.collection.flagstringOverride for the type of local Windows event collection. Possible override values include "0" for legacy mode.NULL
local.win.event.collection.legacystringOverride for the type of local Windows event collection. Possible override values include "1" for legacy mode.NULL
localWindowsEventLog.batchSizeintegerNumber of elements to fetch per batch for Windows Event Log Sources.512
localWindowsEventLog.sleepIntervalMsintegerSleep time in milliseconds to wait in between fetching events for Windows Event Log Sources.0
LogSender.pause.overridebooleanPause sending HTTP data from the log sender to Sumo Logic.false
metadata.cache.expiration.secintegerDuration in seconds to expire and retry fetching local metadata cached by the Collector.600
MetricsSender.pause.overridebooleanPause sending HTTP data from the metric sender to Sumo Logic.false
multiline.maxCharLengthintegerSets the size in KB the Collector reads up to for detecting multiline messages. See [Collecting Multiline Logs](/1021/merge/docs/send-data/reference-information/collect-multiline-logs for details.524288
multiline.maxLinesintegerSets the number of lines the Collector reads up to for detecting multiline messages. See Collecting Multiline Logs for details.2000
offline.numRetriesintegerNumber of retry attempts before entering offline collection mode on connection failure.3
paging.lowerbound.mbintegerSize in megabytes of free storage space available after which the Collector exits flushing mode.32
paging.upperbound.mbintegerSize in megabytes of free storage space available after which the collector enters flushing mode.2048
pileAggregator.maxBatchPayloadSizeintegerMaximum size in bytes to accumulate to flush aggregated piles for log pipeline.4194304
pileAggregator.maxPilesintegerMaximum number of piles to aggregate before flushing piles for log pipeline.5
pileAggregator.metrics.maxBatchPayloadSizeintegerMaximum size in bytes to accumulate to flush aggregated piles for metrics pipeline.1048576
pileAggregator.metrics.maxPilesintegerMaximum number of piles to aggregate before flushing piles for metrics pipeline.10
pileAggregator.metrics.periodintegerTime period in milliseconds to flush aggregated piles for metrics pipeline.1000
pileAggregator.periodintegerTime period in milliseconds to flush aggregated piles for log pipeline.1000
queue.checking.interval.secintegerTime period in seconds the collector will calculate outbound queue statistics.300
queue.max.disk.gbintegerSize in gigabytes for on-disk outbound queue for log sources.3
queue.max.memory.mbintegerSize in megabytes for in-memory outbound queue for log sources.8
queue.metrics.max.disk.gbintegerSize in gigabytes for on-disk outbound queue for metric sources.1
queue.metrics.max.memory.mbintegerSize in megabytes for in-memory outbound queue for metric sources.8
refresh.event.session.periodintegerTime period in milliseconds to refresh the event session for Windows Event Log Sources.3600000
refresh.local.log.names.periodintegerTime period in milliseconds to retrieve log names for new event logs for Windows Event Log Sources.86400000
remote.file.connect.retriesintegerNumber of retry attempts when connecting to a remote file host.3
source.max.threads.numintegerMaximum number of threads to use when scanning files for a given source.6
source.scan.file.cacheTtlintegerMaximum time duration in milliseconds before repopulating directory hierarchy.1800000
source.scan.file.maxAgeintegerMaximum age in days of files to be considered when scanning.36500
ssh.host.verify.filestringFile path of SSH host key verification file to use when verifying remote hosts.NULL
streaming.metrics.hostnamestringOverride the hostname of the syslog server for Streaming Metrics source types.NULL
syslog.dns.cache.timeoutintegerTimeout in milliseconds to resolve DNS host lookup information for Syslog Sources.300000
syslog.hostnamestringHost name that identifies the network interface Syslog Sources should bind to.NULL
tcp.syslog.server.socket.timeout.msintegerDuration in milliseconds socket timeout to use for Syslog Sources. Set to 0 to disable the timeout.120000
threadDumps.enabledbooleanEnable periodic thread dumps to be printed to the collector.log file.false
threadDumps.frequencyMsintegerTime period in milliseconds to log thread dumps when thread dumps are enabled.60000
upgrade.auto.enabledbooleanEnable automatic upgrade check for the Collector.false
upgrade.check.frequencyintegerTime period in seconds to check for upgrades when automatic upgrades are enabled.3600
waiting.time.before.stop.threadintegerDuration in milliseconds to wait before the monitoring of the Sources JSON sync file is stopped.15000
wildcard.inputs.handler.removed.input.timeoutintegerDuration in milliseconds to wait before the monitoring of an unmodified file is stopped.1800000
windows.local.jnibooleanEnable using JNI for local Windows Event Log Sources.true
wrapper.out.oomstringCustom message to log upon OutOfMemory exception from Wrapper.The JVM has run out of memory.
wrapper.out.stopstringCustom message to log upon stopping the Wrapper.Wrapper Stopped
Sumo Logic YouTubeSumo Logic Twitter
Legal
Privacy Statement
Terms of Use

Copyright © 2022 by Sumo Logic, Inc.