Skip to main content

Agent Administration

Start, Stop, or Restart Lacework Agent​

The Lacework agent service is named datacollector. Once installed, Linux utilities like service, initctl, or systemctl can be used to manage the service. Common commands are:

systemctl [start | stop | restart] datacollector
service datacollector [start | stop | restart]
initctl [start | stop | restart] datacollector

View Agent Logs​

Important log messages from an active Lacework agent are appended to the standard log file defined for services on the Linux host where the agent is running. For example, on systemd managed systems, log messages are included in journald. For other systems log messages are included in /var/log/syslog.

Lacework agent also maintains its own debug logs in /var/log/lacework/datacollector.log. Logs are automatically rotated and the maximum expected disk usage is 20MB.

View Agent Versions​

To view where the agents are running in your environment and what version of the agents are running, go to Resources > Agents in the Lacework Console.

  • The Agent monitor table displays the host name and IP address of the machines on which the agent is running and the version number.
  • The Agent upgrades table displays the agent versions that have generated events in your environment over time.