This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Hosts

Axoflow collects and shows you a wealth of information about the hosts of your security data pipeline.

1 - Find a host

To find a specific host, you have the following options:

  • Open the Topology page, then click the name of the host you’re interested in. If you have many host and it’s difficult to find the one you need, use filtering, or grouping.

    Topology view

  • Open the Hosts page and find the host you’re interested in.

    Hosts list

To find or display only specific hosts, you can use the filter bar.

  • Free Text mode searches in the following fields of the host: Name, IP Address, GUID, and FQDN.
  • AQL mode allows you to search in specific labels of the hosts. It also makes more complex filtering possible, using the Equal, Contains, and Match operators. When using AQL mode, Axoflow Console autocompletes the built-in host labels and field names, but doesn’t autocomplete custom labels.

2 - Host information

The Hosts page contains a quick overview of every data source and data processor node. The exact information depends on the type of the host: hosts managed by Axoflow provide more information than external hosts.

Host information

The following information is displayed:

  • Hostname or IP address
  • Metadata labels. These include labels added automatically during the Axoflow curation process (like product name and vendor labels), as well as any custom labels you’ve assigned to the host.

For hosts that have the Axoflow agent (Axolet) installed:

  • The version on the agent
  • The name and version of the log collector running on the host (for example, AxoSyslog or Splunk Connect for Syslog)
  • Operating system, version, and architecture
  • Resource information: CPU and memory usage, disk buffer usage. Click on a resource to open its resource history on the Metrics & health page of the host.
  • Traffic information: volume of the incoming and outgoing data traffic on the host.

For AxoRouter hosts:

For more details about the host, select the hostname, or click .

Host overview

3 - Custom labels and metadata

To add custom labels to a host, complete the following steps. Note that these are static labels. To add labels dynamically based on the contents of the processed data, use the processing steps in data flows.

  1. Find the host on the Hosts or the Topology page, and click on its hostname. The overview of the host is displayed.

    Host overview

  2. Select Edit.

    Edit host metadata

    You can add custom labels in <label-name>:<value> format (for example, the group or department a source device belongs to), or a generic description about the host. You can use the labels for quickly finding the host on the Hosts page, and also for filtering when configuring Flows.

    When using labels in filters, processing steps, or search bars, note that:

    • Labels added to AxoRouter hosts get the axo_host_ prefix.
    • Labels added to data sources get the host_ prefix. For example, if you add a rack label to an edge host, it’ll be added to the data received from the host as host_rack.

    On other pages, like the Host Overview page, the labels are displayed without the prefixes.

  3. Select Save.

4 - Services

The Services page of a host shows information about the data collector or router services running on the host.

This page is only available for managed pipeline elements.

The following information is displayed:

  • Name: Name of the service
  • Version: Version number of the service
  • Type: Type of the service (which data collector or processor it’s running)
  • Supervisor: The type of the supervisor process. For example, Splunk Connect for Syslog (sc4s) runs a syslog-ng process under the hood.

Icons and colors indicate the status of the service: running, stopped, or not registered.

Data collector services running on the host

Service configuration

To check the configuration of the service, select Configuration. This shows the list of related environment variables and configuration files. Select a file or environment variable to display its value. For example:

Configuration file of the service

To display other details of the service (for example, the location of the configuration file or the binary), select Details.

Service details

Manage service

To reload a registered service, select Reload.