Skip to content
Docs
foxborne.comRequest a pilot

Set the collector policy

Choose which journal units and processes the collector reads, how often it samples, how much it spools offline and what it redacts before upload. The policy applies to every enrolled vehicle at its next check-in.

How-toEvery deploymentAdminMarkdown
On this page7

One policy governs every collector in the deployment. It sets the allowlist of journal units and processes, the sample rate, the spool budget and the patterns redacted from journal lines on the vehicle.

Before you start#

  • You need the Admin role. Only admins manage sources and collectors.
  • Enroll at least one vehicle first, as Install and enroll the collector describes.
  • Know the names of the systemd units and processes your investigations need, as they appear on the companion computer. systemctl list-units --type=service lists the service units there.

Change the policy#

  1. Open the policy

    In Sources, open the Vehicle collectors tab and select Collector policy at the top right. The drawer shows the policy in force. Select Edit policy at its foot. The Collector policy dialog opens with the note Applies to every enrolled vehicle at its next check-in.

  2. Set the journal units

    Journal units lists the units whose lines leave the vehicle. The example dataset's policy reads perception.service, mavlink-router.service, chronyd.service, collector.service, kernel.

    The hint states the rule: Only these units are read. Everything else in the journal is ignored on the vehicle. Keep kernel on the list for the kernel's own messages, such as OOM kills and USB disconnects.

  3. Set the processes to sample

    Processes to sample names the processes the collector samples, perception_node, mavlink-routerd in the example. Each sample records CPU, resident memory and the restart count, which the memory_pressure rule reads.

  4. Choose the sample rate and spool budget

    FieldOptionsWhat it sets
    Sample rate1 per second, 2 per second, 5 per secondHow often each process is sampled
    Spool budget100 MB, 250 MB, 500 MBHow much the vehicle holds while it has no uplink

    A higher sample rate fills the spool sooner, so raise the budget with it on vehicles that spend long stretches offline.

  5. Set the redaction patterns

    Redact from journal lines holds regular expressions, separated by commas. The example policy reads AKIA[0-9A-Z]{16}, Bearer [A-Za-z0-9._-]+.

  6. Save

    Select Save. The toast reads Policy saved. Vehicles pick it up at their next check-in.

How redaction works#

The collector matches each pattern against the journal lines it reads, and replaces the matching text on the vehicle, before upload. The secret never leaves the vehicle, and Foxborne never stores it.

PatternWhat it matches
AKIA[0-9A-Z]{16}An AWS access key ID: AKIA followed by 16 uppercase letters or digits
Bearer [A-Za-z0-9._-]+A bearer token: the word Bearer, a space, then letters, digits, dots, underscores or hyphens

Foxborne receives only the redacted line, so a pattern that is too broad removes evidence along with the secret. Test a new pattern against real journal lines before you save it.

Settings, under Redaction, keeps the named Patterns removed from logs. The example deployment lists AWS access keys, Bearer tokens, Passwords in URLs and Internal hostnames matching *.hfr.internal.

Its editor states One per line. Matches are replaced with [redacted] on the vehicle, before upload. See Retention, holds and redaction.

When vehicles pick it up#

Each vehicle applies the policy at its next check-in. A vehicle that is offline, such as one in maintenance, picks it up when it next connects. Segments uploaded before then were collected under the previous policy.

Check the result#

  • The toast reads Policy saved. Vehicles pick it up at their next check-in.
  • The audit log records Changed collector policy for All vehicles, with the detail Units, processes and redaction.
  • As vehicles check in, their new segments carry the new allowlist and redaction.

Troubleshoot#

  • A service's lines never arrive. Its unit is not on Journal units, so the collector ignores it on the vehicle. Add the unit and save.
  • Dropped shows a number. The spool filled while the vehicle was offline, and the oldest low-priority samples were dropped and marked. Raise Spool budget, or lower Sample rate.
  • A secret still appears in a journal line. Add a pattern that matches it. Lines uploaded earlier are originals, written once, and keep their text.
  • Clock shows Not synchronised. The policy does not set time. chrony has no reachable source; see Troubleshoot on the install page.

Next#