File based integration with Google SecOps via Forwarder

Hi,

Could you post the docker command that you are used to exec the forwarder?

Can you share the full error? Is the "No such file or directory error" referencing the forwarder conf file or the audit.log file?

Hi @cmorris ,

Please find the snip of error which i got.

     docker run 

       --detach 

       --name cfps 

       --log-opt max-size=100m 

       --log-opt max-file=10 

       --net=host 

       -v /opt/chronicle/config:/opt/chronicle/external 

       -v /var/log/crowdstrike/falconhostclient:/opt/chronicle/edr 

       gcr.io/chronicle-container/cf_production_stable
   

Sorry but I don’t understand very well the problem, could you post the config file (obviously without the auth section)?

     docker run 

       --detach 

       --name cfps 

       --log-opt max-size=100m 

       --log-opt max-file=10 

       --net=host 

       -v /opt/chronicle/config:/opt/chronicle/external 

       -v /var/log/crowdstrike/falconhostclient:/opt/chronicle/edr 

       gcr.io/chronicle-container/cf_production_stable
   

Can you check if the command below works?

     docker run 

       --detach 

       --name cfps 

       --log-opt max-size=100m 

       --log-opt max-file=10 

       --net=host 

       -v /opt/chronicle/config:/opt/chronicle/external 

       -v /opt/logs:/opt/chronicle/edr 

       gcr.io/chronicle-container/cf_production_stable