Collection

Required Capabilities

You need the Manage or View Collectors role capability to manage or view Collection.

Use the Collection page to manage all of your Collectors and Sources. To access the Collection page, go to Manage Data > Collection > Collection.

Page Capabilities

• Search for a Collector or Source
• View the health of Collectors and Sources
• Upgrade Sources from the Cloud-to-Cloud Integration Framework)
• Upgrade Collectors
• Add an Installed Collector or a Hosted Collector
• Use the Show options to filter the list
• Use the Expand options to show or hide information about the Sources
• Use the paging controls to navigate the list of Collectors

Collector Actions

• Add a Source
• Edit a Collector
• Delete a Collector
• Download a JSON configuration file for scripting or backup
• Restart a Collector

Source Actions

• Edit the Source
• Delete a Source
• Download a JSON configuration file for scripting or backup
• Pause or resume a Source (cloud polling Sources only)
• Show or regenerate a Source URL (HTTP Sources only)
• Show or regenerate a Source token (cloud syslog Source only)

Available Information about Collectors and Sources

• Name. Displays the name of the Collector, and any Sources that are configured under it. It also displays the type of Source (HTTP, Local File, Local Windows Event Log, etc.)

  • Open in Search. Hover over the Name of the Collector or Source and click the Open in Search icon to start a search in the Search page.

  • Tooltip. Hover over a Collector or Source name to display an informational tool tip.

    The Collector's version is provided in the tooltip.

    

• Health. Shows color-coded healthy, error, and warning states for Collectors and Sources so you can quickly determine the health of your Collectors and Sources.

  If an Installed Collector appears offline try restarting the service and testing connectivity.

• Type. Displays whether the Collector is an Installed or Hosted Collector.

• Status. Shows the status of Sources manually paused by users.

• Source Category. Displays the name of the configured Source Category for this Collector or Source.

• Sources. Displays the number of Sources configured under a Collector.

• Last Hour. Displays a graph of the total number of log messages ingested per minute over the past hour.

• Messages. Displays the total number of log messages ingested over the past hour.

Guide contents

In this section, we will introduce the following concepts:

📄️ Search for a Collector or Source

Many Sumo Logic customers have hundreds of collectors and sources installed and configured. But even with only 10 Collectors, sometimes it can be hard to find the one you need in the list.

📄️ Start or Stop a Collector using Scripts

Sumo Logic Collectors start automatically at system startup. The Sumo Logic Collector installation directory comes with a set of scripts used to start, stop, and check the status of the Collector process (Linux/Unix) and service (Windows).

📄️ Edit a Collector

From the Manage Collection page, you can edit some characteristics of a Collector, including its name, description, Host Name, and Category.

📄️ Restart Collectors

This document explains how to initiate a request to restart an Installed

📄️ Edit a Source

From the Manage Collection page, you can edit some characteristics of a Source, including its name, description, Collection time, Source Host, Source Category, Advanced options, and Processing Rules.

📄️ Pause and Resume a Source

You can pause some types of Sources to stop them from sending data to

📄️ Delete a Collector or Source

Deleting a Collector deregisters it with Sumo. This cannot be undone. Installed Collectors shutdown when receiving a 401 response that its credentials are no longer accepted. The Collector and its Sources are removed from the Manage Data \> Collection \> Collection page. Data already collected is not affected and is still searchable.

📄️ Set the Collector CPU Usage Target

An installed collector uses all CPU processing resources available on a machine. Most of the time CPU processing issues don’t arise, but if a lot of log data is being generated, or if you need to protect other processes running on the machine where the collector is installed, you can choose to set a CPU target to limit the amount of CPU processing a collector uses. This option is applied only to local or remote file sources.

📄️ Upgrade Collectors

Upgrade Collectors using the Web Application

📄️ Collector Logs

Installed Collectors store log events in its installation directory under the '/logs' directory. These logs are useful when troubleshooting collection issues.

🗃️ Processing Rules

5 items