Configure the Axon Agent Flat File Collector

This collector is only available through use of the Axon Agent.

For guides on collectors configured without the use of Axon Agents, refer to Collector Configuration Guides.

Add an Axon Agent Flat File Collector

Only Administrators can take this action.

1. In the lower-left corner of the main screen, click the Administration cog.
   The Administration menu appears on the left side.
2. Under Integrations, click Agents.
   The Agents page appears.
3. In the upper-right corner, click + Add Agent Profile.
   The Add Agent Profile Wizard appears.

4. Enter the following information on the Add Basic Profile Information page.
   Fields marked with an asterisk (*) are required.

   Option	Description
   Operating System *	Select the appropriate button to determine the operating system on which this agent will be deployed.
   Agent Profile Name *	Enter a unique name for this Agent Profile.
   Agent Profile Description	Enter an optional detailed description for this Agent Profile.
   Version Preferences	Select the desired Axon Agent version for this profile from the drop-down menu.

5. Click Next.

6. Enter the following information on the Additional Features page.
   Fields marked with an asterisk (*) are required.

   Option	Description
   Flat File Collection	Click the slider button to enable Flat File collection.
   Path *	Enter the file path from which you want to collect logs.  Multiple file paths are accepted, in a comma delimited list. To collect from all files in a directory, add an asterisk (*) to the end of the file path, e.g. /var/log/*
   Exclude Path	Enter a file path you wish to exclude from collection.  Multiple file paths are accepted, as well as wildcard file types.
   Include Filter	Enter a regular expression to filter logs you want to be sent to Axon.
   Exclude Filter	Enter a regular expression to filter logs you want to exclude from being sent to Axon. For more information on log filtering, see Log Filtering Examples below.

7. Click Submit to save this Agent Profile.
   The Agent Profile creation is successful, and it is added to the list of Agent Profiles in Axon.

Log Filtering Examples

Log filtering occurs at the Axon Agent level.  Logs which are filtered out are not searchable or indexed in LogRhythm Axon.

Include Regex Example

• Include regex: ^\d*\s\w*$
• Test string: 385 Interlocken
• This scenario would allow the log "385 Interlocken" because the regex looks for any number of digits, followed by a space, followed by any number of letters.

Exclude Regex Example

• Exclude regex: debug
• Test string: |router| 10.0.0.1 - debug log - An action has occurred
• This scenario would exclude the entire log because the word "debug" (case sensitive) appeared.

Multiple Regex Example

Usage of multiple regex in a single filter can be accomplished through use of the OR operator, '|' (pipe character):

• Example regex: mountain|tree
• Test strings:
  • mountain
  • tree
• The regex above will match both words "mountain" and "tree"
• This example can be extended to much more complicated regex.  Use of ( ) for logical grouping is recommended.

Use of regular expression filtering may impact logging performance/throughput by an indeterminate amount.  Regular Expressions which are excessively long, complex or use lookaheads/lookbehinds should be vetted for performance before usage in a filter.