Manage Collectors

In Graylog 7.2, Graylog Collector has been released as a preview feature for evaluation and feedback purposes. This feature's design and behavior could change significantly in future releases. To share feedback on your experience with Graylog Collector, email feedback@graylog.com.

Enrolled collectors appear on the Instances tab, where you can move them between fleets and remove them. This article explains how to reassign collectors, manage the enrollment tokens that let new ones join, and decommission a host you no longer need.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

  • You must be a Graylog administrator or have the Collectors Manager role to manage collectors. A user with the Collectors Reader role can view collectors but cannot reassign them, delete them, or manage tokens.

  • You have administrator access to any host where you uninstall a collector, meaning sudo on Linux and macOS or administrator rights on Windows.

Reassign Collectors to a Different Fleet

A collector belongs to exactly one fleet and takes its configuration from that fleet. Moving a collector to another fleet replaces what it collects, and the new fleet's sources reach it within seconds.

Reassign a collector when the host's job changes and it should collect something different, or when a collector enrolled with the wrong token and joined the wrong fleet. Because the token determines the fleet, reassigning is how you correct that without touching the host.

To reassign a collector, go to System > Collectors, then select the Instances tab:

  1. Select the collectors to reassign.

    • For a single collector, select More on its row, then select Reassign to fleet.

    • For several, select their checkboxes, then select Bulk actions > Reassign to fleet.

  2. Choose the destination fleet from Select a fleet.

  3. Select Reassign instance.

Manage Enrollment Tokens

An enrollment token lets new collectors join the fleet it was generated for. Existing tokens are listed on System > Collectors > Deployment, on the Enrollment tokens sub-tab, showing each token's fleet, creator, expiry, usage count, and when it was last used.

Deleting a token prevents further enrollments with it. Collectors that already enrolled are unaffected, because they authenticate with their own certificates from that point on.

To delete a token:

  1. Go to System > Collectors, then select the Deployment tab.

  2. Select the Enrollment tokens sub-tab.

  3. Select More on the token's row.

  4. Select Delete.

Rotate a long-lived token by generating a replacement and then deleting the old one. Collectors enrolled with the old token keep working throughout.

Review the Usages count periodically. A long-lived token used more often than your rollout accounts for has been reused beyond its intended purpose, and deleting it stops any further enrollments.

Decommission a Collector Host

Decommission a collector host when the host is being retired, or when you want to stop collecting from a host that stays in service. Removing the collector is more thorough than disabling its sources, because it takes the agent off the host as well.

Remove the collector from the host before deleting it in Graylog. Deleting the instance while the collector is still running only causes it to enroll again and reappear in the list.

Uninstalling keeps the enrollment configuration and certificates by default, so reinstalling on the same host stays enrolled. Use the purge option for the platform to remove them as well.

  1. Stop and disable the service:

    Copy 
    sudo systemctl disable --now graylog-collector

  2. Remove the package. For Debian and Ubuntu, run the following command:

    Copy 
    sudo apt-get purge graylog-collector

    For Red Hat Enterprise Linux (RHEL) and derivatives, run the following command:

    Copy 
    sudo rpm -e graylog-collector

    On Debian and Ubuntu, apt-get remove keeps /var/lib/graylog-collector, where the certificates and enrollment state live. apt-get purge removes that directory and the service user as well.

    Purging does not remove /etc/graylog/collector/enrollment.env, because that file is created during installation rather than shipped with the package. Delete the directory to remove the token from the host and to keep a later install from enrolling against the old server.

Uninstall Graylog Collector from Apps & features, or run the following command:

Copy 
msiexec /x graylog-collector-<version>.msi /qn REMOVE_DATA=1

REMOVE_DATA=1 also deletes the configuration, keys, and enrollment data. Omitting it leaves them in place so a reinstall stays enrolled.

Run the uninstall script:

Copy 
sudo "/Library/Application Support/Graylog/Graylog Collector.app/Contents/Resources/uninstall.sh"

Add --purge to remove the configuration and enrollment data as well, including the token.

Then remove the collector from Graylog. Go to System > Collectors, select the Instances tab, select the collector's row, and delete it.

A collector that stops reporting is also removed automatically after it passes the expiration threshold that you set in Configure Collector Settings.

Moving a collector to a different Graylog cluster follows the same route. Uninstall it on the host, delete any enrollment configuration the uninstall leaves behind, then install it again using an enrollment token from the new cluster. A collector cannot be re-pointed in place because it keeps the certificate and connection settings from the cluster it first enrolled with.

Troubleshooting and Common Issues

The following section outlines troubleshooting steps for common issues to assist you in resolving potential challenges you may encounter.

Collector Reappears After Deletion

Deleting a collector removes it from Graylog but does not stop or uninstall it on the host. A collector that is still running re-enrolls with the certificate it already holds and returns to the list within seconds. Uninstall it on the host first, then delete it in Graylog.

Further Reading

Explore the following additional resources and recommended readings to expand your knowledge on related topics: