Axoflow collects and shows you a wealth of information about the hosts of your security data pipeline.
1 - Find a host
To find a specific host, you have the following options:
-
Open the Topology page, then click the name of the host you’re interested in. If you have many host and it’s difficult to find the one you need, use filtering, or grouping.
-
Open the Hosts page and find the host you’re interested in.
To find or display only specific hosts, you can use the filter bar.
- Free Text mode searches in the following fields of the host: Name, IP Address, GUID, and FQDN.
- AQL mode allows you to search in specific labels of the hosts. It also makes more complex filtering possible, using the Equal, Contains, and Match operators. When using AQL mode, Axoflow Console autocompletes the built-in host labels and field names, but doesn’t autocomplete custom labels.
2 - Host information
The Hosts page contains a quick overview of every data source and data processor node. The exact information depends on the type of the host: hosts managed by Axoflow provide more information than external hosts.
The following information is displayed:
- Hostname or IP address
- Metadata labels. These include labels added automatically during the Axoflow curation process (like product name and vendor labels), as well as any custom labels you’ve assigned to the host.
For hosts that have the Axoflow agent (Axolet) installed:
- The version on the agent
- The name and version of the log collector running on the host (for example, AxoSyslog or Splunk Connect for Syslog)
- Operating system, version, and architecture
- Resource information: CPU and memory usage, disk buffer usage. Click on a resource to open its resource history on the Metrics & health page of the host.
- Traffic information: volume of the incoming and outgoing data traffic on the host.
For AxoRouter hosts:
- The connectors (for example, OpenTelemetry, Syslog) configured on the host.
For more details about the host, select the hostname, or click ⋮.
3 - Custom labels and metadata
To add custom labels to a host, complete the following steps. Note that these are static labels. To add labels dynamically based on the contents of the processed data, use the processing steps in data flows.
-
Find the host on the Hosts or the Topology page, and click on its hostname. The overview of the host is displayed.
-
Select Edit.
You can add custom labels in
<label-name>:<value>
format (for example, the group or department a source device belongs to), or a generic description about the host. You can use the labels for quickly finding the host on the Hosts page, and also for filtering when configuring Flows.When using labels in filters, processing steps, or search bars, note that:
- Labels added to AxoRouter hosts get the
axo_host_
prefix. - Labels added to data sources get the
host_
prefix. For example, if you add a rack label to an edge host, it’ll be added to the data received from the host ashost_rack
.
On other pages, like the Host Overview page, the labels are displayed without the prefixes.
- Labels added to AxoRouter hosts get the
-
Select Save.
4 - Services
The Services page of a host shows information about the data collector or router services running on the host.
This page is only available for managed pipeline elements.
The following information is displayed:
- Name: Name of the service
- Version: Version number of the service
- Type: Type of the service (which data collector or processor it’s running)
- Supervisor: The type of the supervisor process. For example, Splunk Connect for Syslog (
sc4s
) runs a syslog-ng process under the hood.
Icons and colors indicate the status of the service: running
, stopped
, or not registered
.
Service configuration
To check the configuration of the service, select Configuration. This shows the list of related environment variables and configuration files. Select a file or environment variable to display its value. For example:
To display other details of the service (for example, the location of the configuration file or the binary), select Details.
Manage service
To reload a registered service, select Reload.