| Anchor |
|---|
| Armor Agent - Collecting Linux and Windows Standard Logs |
|---|
| Armor Agent - Collecting Linux and Windows Standard Logs |
|---|
|
Armor Agent - Collecting Linux and Windows Standard Logs
...
Use the following commands to manage the Logging service - Filebeat and Winlogbeat (for Windows only).
Install Logging:
| Code Block |
|---|
| theme | Midnight |
|---|
| firstline | 1 |
|---|
| linenumbers | true |
|---|
|
Windows: C:\.armor\opt\armor.exe logging install
Linux: /opt/armor/armor logging install |
Uninstall Logging:
| Code Block |
|---|
| theme | Midnight |
|---|
| firstline | 1 |
|---|
| linenumbers | true |
|---|
|
Windows: C:\.armor\opt\armor.exe logging uninstall
Linux: /opt/armor/armor logging uninstall |
Logging Help
| Code Block |
|---|
| theme | Midnight |
|---|
| firstline | 1 |
|---|
| linenumbers | true |
|---|
|
Windows: C:\.armor\opt\armor.exe logging help
Linux: /opt/armor/armor logging help |
| Expand |
|---|
| title | Filebeat Sync Configuration Commands for Linux |
|---|
|
Add new paths to filebeat config | Code Block |
|---|
| /opt/armor/armor logging add-file-paths <paths to file locations> |
| Remove paths from filebeat config | Code Block |
|---|
| /opt/armor/armor logging remove-file-paths <paths to file locations> |
| List added config paths | Code Block |
|---|
| /opt/armor/armor logging describe-file-paths |
| Sync filebeat config | Code Block |
|---|
| /opt/armor/armor logging sync-file-paths |
|
|
Armor Agent - Collecting Custom Windows System Event Logs
Add new paths to filebeat config
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging add-file-paths <paths to file locations> |
Remove paths from filebeat config
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging remove-file-paths <paths to file locations> |
List added config paths
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging describe-file-paths |
Sync filebeat config
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging sync-file-paths |
Add winlogbeat event logs
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging add-event-logs <add events> |
Remove winlogbeat event logs
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging remove-event-logs <add events> |
List Event logs
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging describe-event-logs |
Sync event logs
| Code Block |
|---|
|
C:\.armor\opt\armor.exe logging sync-event-logs |