OneAgent log data formats
powered by Grail
Log Monitoring can read and analyze:
Windows event logs
System, Security, and Application logs are automatically discovered on hosts. Other custom event-log format logs can be added manually on the environment level. The timestamp is sourced from an event's attribute,
Any plain-text log file is valid as long as it is encoded in UTF-8 or UTF-16. The timestamp is detected automatically when it is present, according to the rules described in Supported timestamp formats (Logs Classic). It is also possible to configure your timestamp. If no timestamp is present, the log format is still valid. In such case, each line that doesn't start with a whitespace is treated as the beginning of a new log record, and is automatically assigned a timestamp that is the time of reading a log record by OneAgent.
There is no specific support for JSON. It is treated as text.
Incorrect date formats
Any log entry with an unrecognized timestamp will be adjusted with the current timestamp to allow the log entry to be processed.
Examples of valid log file time formats
The proper timestamp format consists of both date and time. The list below covers possible time formats, which need to be paired with the allowed date formats listed in the next section:
112:23:34.123212:23:34.123GMT+0100312:23:34.123 GMT+010040:00:00 GMT50:00:00 GMT+0100600:00:00712:13:01+0100812:13:02.123912:13:03.123123+01001012:13:02,1231112:13:03,123123+01001212:13:04GMT1312:13:05GMT+01001412:13:06GMT+011512:13:09+01001612:13:10+011712:13:12+02001812:13:13.123pm1912:13:14.123 AM2012:13:15.123PM+012112:13:16.123 AM+022212:13:17CEST2312:13:18 CET2400:13:19
Examples of valid log file timestamps
Below are the date formats that need to be paired with the time formats listed in the previous section:
12018-04-06 09:54:04.839 UTC22018-04-06 11:01:19,62532018/04/06 11:06:23 UTC4Apr 6 12:23:525Apr-6 13:35:57.621