Troubleshooting Log Management and Analytics

Ingested logs don't look as expected.

For example, the content is trimmed, the timestamp is corrected, the processing rule seems not to work.

Answer

The log ingest pipeline consists of several stages where logs are processed, checked against product characteristics and limits. Particular log record contains warnings regarding issues that occurred in the log ingest and processing pipeline. Warnings are persisted and stored in dt.ingest.warnings attribute for each log record individually. See list and description of all possible log ingestion warnings.

OneAgent is not ingesting configured log records.

If OneAgent is not ingesting log records from a log file despite it is configured to be ingested and either automatically detected or added as a custom log source, then Log Agent Security rules might be violated. See Security rules for more information.