# Set the collector policy URL: /collect/collector/policy Choose which journal units and processes the collector reads, how often it samples, how much it spools offline and what it redacts before upload. The policy applies to every enrolled vehicle at its next check-in. One policy governs every collector in the deployment. It sets the allowlist of journal units and processes, the sample rate, the spool budget and the patterns redacted from journal lines on the vehicle. ## Before you start [#before-you-start] * You need the **Admin** role. Only admins manage sources and collectors. * Enroll at least one vehicle first, as [Install and enroll the collector](/collect/collector/install) describes. * Know the names of the systemd units and processes your investigations need, as they appear on the companion computer. `systemctl list-units --type=service` lists the service units there. ## Change the policy [#change-the-policy] In **Sources**, open the **Vehicle collectors** tab and select **Collector policy** at the top right. The drawer shows the policy in force. Select **Edit policy** at its foot. The **Collector policy** dialog opens with the note **Applies to every enrolled vehicle at its next check-in.** **Journal units** lists the units whose lines leave the vehicle. The example dataset's policy reads `perception.service, mavlink-router.service, chronyd.service, collector.service, kernel`. The hint states the rule: **Only these units are read. Everything else in the journal is ignored on the vehicle.** Keep `kernel` on the list for the kernel's own messages, such as OOM kills and USB disconnects. **Processes to sample** names the processes the collector samples, `perception_node, mavlink-routerd` in the example. Each sample records CPU, resident memory and the restart count, which the `memory_pressure` rule reads. | Field | Options | What it sets | | ---------------- | ---------------------------------------- | ------------------------------------------------- | | **Sample rate** | 1 per second, 2 per second, 5 per second | How often each process is sampled | | **Spool budget** | 100 MB, 250 MB, 500 MB | How much the vehicle holds while it has no uplink | A higher sample rate fills the spool sooner, so raise the budget with it on vehicles that spend long stretches offline. **Redact from journal lines** holds regular expressions, separated by commas. The example policy reads `AKIA[0-9A-Z]{16}, Bearer [A-Za-z0-9._-]+`. Select **Save**. The toast reads **Policy saved. Vehicles pick it up at their next check-in.** ## How redaction works [#how-redaction-works] The collector matches each pattern against the journal lines it reads, and replaces the matching text on the vehicle, before upload. The secret never leaves the vehicle, and Foxborne never stores it. | Pattern | What it matches | | ------------------------ | ---------------------------------------------------------------------------------------------- | | `AKIA[0-9A-Z]{16}` | An AWS access key ID: `AKIA` followed by 16 uppercase letters or digits | | `Bearer [A-Za-z0-9._-]+` | A bearer token: the word `Bearer`, a space, then letters, digits, dots, underscores or hyphens | Foxborne receives only the redacted line, so a pattern that is too broad removes evidence along with the secret. Test a new pattern against real journal lines before you save it. **Settings**, under **Redaction**, keeps the named **Patterns removed from logs**. The example deployment lists **AWS access keys**, **Bearer tokens**, **Passwords in URLs** and **Internal hostnames matching** `*.hfr.internal`. Its editor states **One per line. Matches are replaced with \[redacted] on the vehicle, before upload.** See [Retention, holds and redaction](/security/retention). ## When vehicles pick it up [#when-vehicles-pick-it-up] Each vehicle applies the policy at its next check-in. A vehicle that is offline, such as one in maintenance, picks it up when it next connects. Segments uploaded before then were collected under the previous policy. ## Check the result [#check-the-result] * The toast reads **Policy saved. Vehicles pick it up at their next check-in.** * The audit log records **Changed collector policy** for **All vehicles**, with the detail **Units, processes and redaction**. * As vehicles check in, their new segments carry the new allowlist and redaction. ## Troubleshoot [#troubleshoot] * **A service's lines never arrive.** Its unit is not on **Journal units**, so the collector ignores it on the vehicle. Add the unit and save. * **Dropped shows a number.** The spool filled while the vehicle was offline, and the oldest low-priority samples were dropped and marked. Raise **Spool budget**, or lower **Sample rate**. * **A secret still appears in a journal line.** Add a pattern that matches it. Lines uploaded earlier are originals, written once, and keep their text. * **Clock shows Not synchronised.** The policy does not set time. chrony has no reachable source; see [Troubleshoot](/collect/collector/install#troubleshoot) on the install page. ## Next [#next] * [The companion collector](/collect/collector) explains spooling, the lost-data marker and the clock on every sample. * [Retention, holds and redaction](/security/retention) covers the named redaction patterns in **Settings**. * [Collector JSONL records](/reference/collector-jsonl) lists every field of a process sample.