FAQ

How to submit a support request?

If you have a support contract, send an email to support@outcoldsolutions.com. When you sign the contract, you nominate the people in your organization authorized to open requests - contact your procurement department to add more.

Include the following in every request:

• License ID (not the license key). The monitoring apps show it under Setup › Collectord usage, and Collectord’s log names it in its hourly license check: in license-check kubernetes BG5183Q89IE2G 0 0 ..., the License ID is BG5183Q89IE2G.
• The customer name, if you’re a partner or contractor opening a request on someone else’s behalf.
• A short incident description in the email subject.
• Incident details in the body. The more you include up front, the faster we can help. In most cases we’ll ask for diagnostic information from the Collectord instance on the node or host where the issue is happening: that archive holds most of what we need, the Collectord version included. Collect it with the steps for your product - Kubernetes, OpenShift, Docker, Linux, macOS, ElasticSearch and OpenSearch or syslog - and send it with Upload support diagnostics.
• If you can’t share diagnostic information, describe the issue in as much detail as possible and include the Collectord version you’re running.

Kubernetes Search, Search for AWS and OS AI Agent run without Collectord; their support pages say what to send: Kubernetes Search, Search for AWS, OS AI Agent.

A few things that help us help you faster:

• Email is our primary support channel. We’ll follow up with a phone call or web meeting if it’s useful.
• You can keep your team in CC, but please respect the contract and keep that list small - we can’t respond to people who aren’t covered.
• One support request per email thread. If you have multiple issues, open multiple requests.

I received a license. How do I apply it?

Collectord reads its license from its configuration: license in the [general] section, beside acceptLicense = true. From a configuration file, Collectord picks up a new license within moments, without a restart. Where the configuration lives depends on the product:

• Kubernetes and OpenShift - Monitoring Kubernetes and OpenShift, and forwarding to ElasticSearch, OpenSearch or syslog: with Helm, set collectord.configuration.general.license in your values; with a manifest, set the license = line in its ConfigMap and apply it again. See the installation pages for Kubernetes, OpenShift, ElasticSearch and OpenSearch and syslog.
• Docker and Podman - the COLLECTOR__LICENSE=general__license=... environment variable of the Collectord container, which takes effect when you re-create the container. See Installation.
• Linux - license in /opt/collectorforlinux/etc/002-user.conf. See Installation.
• macOS - license in /opt/collectorformacos/etc/002-user.conf, or in the settings profile your MDM deploys. See Installation.
• Windows Containers - license in Collectord’s configuration file. See Installation.

How much data does your application generate?

Mostly logs, and how much your workloads log is theirs to decide - so measure it. The Splunk Usage Report under Setup in Monitoring Kubernetes, OpenShift, Docker, Linux and macOS shows what Collectord’s data costs on your Splunk license, read from Splunk’s own license meter: per day, by source type and by index, and on its tabs by host, source, the heaviest log patterns, and what Collectord read and posted.

Splunk licenses the text of each event. The metadata Collectord attaches - cluster, namespace, pod, container, host and the rest - travels as indexed fields, which don’t count toward the license; they cost disk instead.

What Collectord adds beside your logs, measured on our Kubernetes test cluster with Splunk 10.4, stats in the events index:

Kubernetes objects add objects × object size × 1440 / refresh minutes bytes a day: a Pod object is about 3.9 KB, a Node about 8.6 KB, and the shipped watches re-send every 45 minutes. Sending the stats to a metrics index costs about 1.5 times the license and half the disk.

To read the license meter yourself, by source type, as Monitoring Windows Containers users do (license_usage.log is on the license manager):

1index=_internal source=*license_usage.log* type=Usage
2| eval MB=b/1024/1024
3| timechart span=1d sum(MB) by st

To send less, see Reduce log volume.

Performance

Measured on Collectord for Docker 26.10.1 reading 10 containers that each write 1,000 lines of 1 KB a second, 10 MB a second in all, Collectord used about 0.36 of a core and 22.5 MiB of memory; spread over 100 containers, 0.41 of a core and 45 MiB. Grouping repeated lines, folding storms and the pattern report add to that; Reduce log volume has what each costs.

Do you support a specific version of Kubernetes, OpenShift and Docker?

Monitoring Kubernetes, OpenShift, Docker, Linux and macOS run on Splunk Enterprise 9.2 or later and on Splunk Cloud Platform; Monitoring Windows Containers, on its own 2.1 release, on Splunk 6.5 or later. Collectord 26.10 runs on Kubernetes 1.24 or later and OpenShift 4.11 or later, on Docker Engine 25.0 or later (20.10 to 24 through API version negotiation), on Linux hosts with glibc 2.28 or later, and on Apple Silicon Macs with macOS 14 Sonoma or later, on amd64 and arm64. Our OpenShift monitoring solution is Red Hat certified. Each product’s installation page lists its requirements: Kubernetes, OpenShift, Docker, Linux, macOS, ElasticSearch and OpenSearch and syslog.

Why is it called Outcold Solutions?

Outcold Solutions takes its name from our founder’s recognized industry handle “outcoldman,” which became synonymous with expertise in Docker and Splunk integration during the early adoption phase of containerization. Our founder’s deep technical knowledge and early adoption of containerization made them a trusted voice in the enterprise monitoring community, establishing the technical foundation that drives our solutions today.

Our founder’s industry contributions include developing the original Docker images for Splunk that became the official Splunk Docker images, contributing to the Splunk logging driver for Docker, and serving as a technical authority through speaking engagements at Splunk Conferences. This proven track record of innovation and enterprise-grade solutions continues to guide our commitment to delivering reliable, scalable monitoring platforms for mission-critical environments.