Log Routing — Centralized or Local
Every collector ships the logs it receives somewhere. By default that is GridNMS itself. If you need log data to stay inside your own network, you can run an Edge appliance on your hardware and point collectors at it instead.
The choice is made per collector, so a single deployment can keep one site’s logs local while the rest ship centrally.
Where to find it
Section titled “Where to find it”Go to Configure → Collectors, open a collector, and select its Settings tab. The Log routing panel asks one question: where this collector ships its logs.
| Mode | What it does |
|---|---|
| Centralized | The collector ships logs to GridNMS. This is the default and needs no extra infrastructure. |
| Local (Edge) | The collector ships logs to an Edge appliance you run. Logs stay on your network and never leave it. |
What an Edge is
Section titled “What an Edge is”An Edge is a log store you run yourself, on your own hardware, bound to one of your sites. It does two jobs:
- It receives logs from the Local-mode collectors in that site, and keeps them under your own retention and archiving settings.
- It answers queries from GridNMS, so the Logs page and your scheduled detections still work exactly as they do with centralized logging. You search the same way; only the storage location moves.
You own the storage. Nothing about a log’s content, retention, or archive destination leaves your network.
Setting it up
Section titled “Setting it up”There are three steps, in this order: install the appliance, register it in GridNMS, then point collectors at it.
1. Install the appliance
Section titled “1. Install the appliance”Download the Edge appliance from the portal Downloads page — it’s listed for self-hosted and air-gapped plans, as a Linux x64 image archive.
The archive contains everything the appliance needs; nothing is fetched from the internet at install time, so it works on a disconnected network. Unpack it on the host that will store the logs, set a store password and an ingest token in the configuration file, and run its installer. When it comes up, confirm it answers on its own address before moving on.
Give the appliance a stable DNS name and a certificate the collectors and GridNMS can trust — the same considerations as any other service you run. See TLS & certificates.
2. Register the Edge in GridNMS
Section titled “2. Register the Edge in GridNMS”Go to Configure → Collectors and open Edges (also reachable as Manage Edges from a collector’s Log routing panel). Click Register Edge and fill in:
| Field | What to enter |
|---|---|
| Name | A friendly label, e.g. HQ Edge. |
| Site | The site this Edge serves. Leave it tenant-wide only if it serves every site. |
| Edge URL | The address GridNMS reaches it on, e.g. https://log-edge.lan:3002. |
| Query token | The token you set on the appliance, so GridNMS can read logs back from it. |
Saving it shows a back-channel token once. Copy it then — it is never shown again. The appliance uses it to authenticate back to GridNMS. If you lose it, use the rotate action on the Edge’s row to issue a new one, and update the appliance with the new value.
The Edges list shows each Edge’s site, address, whether its tokens are set, and when GridNMS last heard from it. Last seen: never on an Edge you have already configured means the appliance can’t reach GridNMS — check its address and its back-channel token first.
3. Point collectors at it
Section titled “3. Point collectors at it”Back on the collector’s Settings → Log routing panel, choose Local (Edge) and enter:
- the Edge log store URL — the same address you registered, and
- the Edge ingest token — the token the appliance accepts logs with. Leave it blank to use the platform token.
Save. The collector picks the change up on its next configuration refresh and starts routing its logging channel to the Edge. Its syslog and trap traffic now lands in your Edge’s store, and GridNMS receives none of that raw log data.
The collector’s on-disk buffer behaves exactly as it does in Centralized mode: it absorbs traffic while the Edge is unreachable and ships it on reconnect, so a restart or a brief network outage doesn’t lose logs.
Verifying it worked
Section titled “Verifying it worked”- On the Edges page, the Edge’s Last seen should advance.
- Open Logs and filter to a device served by that collector. Results come back exactly as before — the query is answered by your Edge.
- On the collector’s Health tab, the logging channel’s delivery statistics now count against the Edge.
If logs stop arriving after the switch, the cause is almost always one of three things: the Edge URL is wrong or unreachable from the collector, the ingest token doesn’t match what the appliance expects, or the appliance’s certificate isn’t trusted by the collector. Check them in that order.
Where to go next
Section titled “Where to go next”- Log storage & retention — how long logs are kept, and archiving to your own storage.
- Receiving syslog & traps — getting devices to send logs to a collector in the first place.
- Networks & sites — how sites bound an Edge’s scope.
docs built 2026-09-26 · 195c6d00