Site CollectorSite Collector Administration Guide

Prechecks run automatically during new installations (fresh installs) and upgrades. Prechecks are also useful to run manually after network or OS updates.

You can execute prechecks before installation, after network or OS modifications, or while diagnosing connectivity issues. The collcli precheck command validates if a host meets prerequisites for collector installation and operation. The command evaluates environment, connectivity, system, and certificate conditions and reports PASS, WARN, or FAIL for them.

The precheck validates the following components.

Following are the precheck examples.

# Validate a Linux File Collector host
collcli precheck lfc --ngsc-ip <site-collector-ip>

# Validate a Windows Event Log Collector host
collcli precheck welc --ngsc-ip <site-collector-ip>

# Validate all installed collectors on the host
collcli precheck --ngsc-ip <site-collector-ip>

The precheck results indicate success with a PASS, identify non-critical issues requiring review with a WARN, and highlight critical unmet conditions that must be remediated before proceeding with a FAIL.

Manage collectors using the Site Collector User Interface (UI), where a background assistant on each of your host computers automatically checks in every minute to run any tasks you have lined up.

Refer to the following information for details about UI action and host behavior.

It is recommended to initiate troubleshooting via the user interface as the primary course of action. If troubleshooting via the user interface as a preferred primary method fails, as a fallback option you can manage the data service on the host using the following collcli commands.

# Start the data service
collcli start --collector-type lfc

# Stop the collector (persistent — remains stopped until explicitly started)
collcli stop --collector-type lfc

# Restart the data service
collcli restart --collector-type lfc

# Check current status
collcli status --collector-type lfc

Upgrade collectors by clicking Upgrade in the Site Collector user interface (UI). The management agent automatically downloads the new version, backs up your current setup, and switches to the update. In case of errors, the agent safely restores your last working setup and displays the error on the UI. Once the update finishes successfully, the collector automatically starts running again, even if you had stopped it before the upgrade. For more information, see Upgrade the Agent Collector Instances.

It is recommended to upgrade collectors via the user interface as the primary course of action. If this preferred primary method fails, as a fallback option, to upgrade collectors, execute the following command on the host.

collcli upgrade --collector-type lfc --force

The collcli upgrade command reads the Site Collector address and template ID from the installation metadata. Use the following additional flags when necessary.

During an upgrade, Site Collector downloads the new version first. If this download fails, your collector simply keeps running without any changes and a back up of the current setup is created. If the download succeeds, Site Collector installs the new version, and restarts your services. The collector is validated to confirm operational health. If the update succeeds, the UI displays a message to indicate that the update is complete. Site Collector keeps your backup for 24 hours just in case, then deletes it. If the update fails, the previous collector version is restored automatically and services are restarted. The Site Collector UI indicates failure and the associated reason. If the update is interrupted (for example, by a computer restart), the system is automatically reset to its original setup before another update attempt is made. Progress and errors are recorded in a background activity log so that what happened can be easily tracked.

If a host is running the previous Exabeam management agent, migration to the Universal Collector management agent is performed automatically from the Site Collector UI using the Upgrade action; no manual reinstall steps are required.

Collectors use digital security certificates to create safe and encrypted connections with Site Collector. These certificates are subject to expiration and require periodic renewal. Collector security certificates are issued and managed by Site Collector, not by individual collectors. Renewals are performed on the Site Collector via Certificate Rotation on the New-Scale Security Operations Platform or by a Site Collector administrator.

Once the Site Collector acquires new certificates, each individual collector updates automatically by having its management agent check the certificate status every six hours. If the certificates are within seven days of expiration, or have expired, or if the certificate authority changes, the agent automatically downloads the current certificates. The agent then installs these certificates, performs a brief collector restart, and restores the previous certificates automatically if the new ones fail validation. Finally, if the Site Collector is unreachable or has not been renewed, the collector continues to operate with its existing certificates and retries the update periodically.

The primary and recommended method for certificate update is through the user interface; use the manual method only if primary update and troubleshooting via UI fails. Normally, you do not need to update certificates manually. Every six hours, the management service automatically checks certificates, detects CA changes, and renews them before they expire. It also tests the new connection and rolls back to safety if the renewal fails.

As a best practice, if a collector has service errors, missing configuration files, or unknown issues, run the repair command instead of the certupdate command. The repair process automatically checks and restores certificates as part of a full health check.

To get Site Collectors' latest security certificates, after any update such as certificate rotation, run the following command.

# Update certificates for one collector
collcli certupdate --collector-type lfc

# Update certificates for all installed collectors on this host
collcli certupdate --all

The command downloads, validates, and installs certificates from Site Collector and restarts the collector. If any download or validation fails, existing certificates are retained.

To force a fresh download and clear any old certificate files, run the following command.

collcli certupdate --collector-type lfc --refetch-certs

The primary and recommended method for certificate recovery is through the user interface. Use the following method only as a fallback option.

The collcli certupdate command retrieves and installs the latest certificates from the Site Collector. This command is aimed at certificate-specific recovery and not at a comprehensive installation validation.

Following are some examples of the collcli certupdate command usage.

# Update certificates for a single collector
collcli certupdate --collector-type lfc

# Update certificates for all installed collectors on a host
collcli certupdate --all

# Force retrieval of a fresh certificate bundle
collcli certupdate --collector-type lfc --refetch-certs

Use the collcli certupdate command in case of the following scenario.

Use the collcli certupdate command to complete the following tasks.