These docs are for Cribl Edge 4.17 and are no longer actively maintained.

See the latest version (4.20).

Learn about running Cribl Edge on macOS.

Cribl Edge on macOS offers easy-to-use tools for exploring and collecting macOS events. You can run Cribl Edge on a supported macOS machine to collect logs and track local files.

Edge on macOS does not include support for system metrics or system state at this time. See below for a more detailed list of limitations.

Limitations ​

Cribl Edge on macOS is subject to the following limitations.

Modes ​

Cribl Edge on macOS supports only the following modes:

• Edge: Single
• Edge: Managed Edge (managed by Leader)

This means you can’t switch Cribl Edge on macOS into Cribl Stream mode (Single-instance, Worker, or Leader).

You can, however, switch between the Cribl Edge supported modes via the UI, in Settings > Distributed Settings > Mode.

Do not select an unsupported mode from this drop-down! Doing so will cause the Cribl service to fail.

Sources and Destinations ​

Cribl Edge on macOS supports the same Sources and Destinations as Cribl Edge on Linux, with the following exceptions.

Unavailable Sources ​

The following Sources are unavailable on macOS

• System Metrics Source
• System State Source

Unavailable Destinations ​

The following Destination is unavailable on macOS:

• Amazon Security Lake Destination

Other Limitations on Sources and Destinations ​

Other limitations include:

• The Kafka Destination does not support Kerberos authentication on macOS.
• The File Monitor Source only allows Manual discovery mode, not Auto.

Functions ​

The Grok Function is unavailable on macOS. If you include it in a Pipeline, Cribl Edge processing will skip over it.

Data Formats ​

Cribl Edge on macOS does not support reading or writing Parquet files. This is a limitation on the following Destinations: Amazon S3, Azure Blob Storage, MinIO, and FileSystem/NFS.