Try it free

Log Monitoring configuration (Logs Classic)

  • Dynatrace Classic
  • 5-min read

Log Monitoring Classic

By default, Log Monitoring is activated in your Dynatrace environment. To start ingesting logs, depending on your use case, you need to either configure log storage rules on OneAgents or send logs to ingest APIs.

  • Log ingest rules (Logs Classic)
  • Log ingestion API (Logs Classic)

You can confirm that Log Monitoring is enabled or you can enable it globally or on a host level, but checking the status and enabling or disabling Log Monitoring is optional in most cases. If you plan to use Log Monitoring, you can focus on OneAgent settings that directly affect how Log Monitoring operates.

  • OneAgent settings.

Check Log Monitoring status

Optional

You can check if Log Monitoring is enabled in your Dynatrace environment globally (Dynatrace web UI), or you can check if Log Monitoring is enabled on a host level (OneAgent CLI).

  • To check if Dynatrace Log Monitoring is enabled globally:

    1. Go to Settings > Monitoring > Monitored technologies.
    2. Find Log Monitoring in the list of supported technologies, and select Edit (pencil icon).
    3. Check if Monitor Log Monitoring on every host option is enabled.

  • To check if Dynatrace Log Monitoring is enabled on a host level:
    Use OneAgent CLI and run the oneagentctl command with the --get-app-log-content-access parameter to check whether Log Monitoring is enabled:

    • Linux: ./oneagentctl --get-app-log-content-access
    • Windows: .\oneagentctl.exe --get-app-log-content-access

Enable or disable Log Monitoring

Optional

Similarly to checking Log Monitoring status, you can enable or disable Log Monitoring in your Dynatrace environment globally (Dynatrace web UI), or on a host level (OneAgent CLI).

  • To activate Dynatrace Log Monitoring globally:

    1. Go to Settings > Monitoring > Monitored technologies.
    2. Find Log Monitoring in the list of supported technologies, and select Edit (pencil icon).
    3. Turn on Monitor Log Monitoring on every host.

  • To enable or disable Dynatrace Log Monitoring on a host level:
    Use OneAgent CLI and run the oneagentctl command-line interface to run the following command at the individual host level.
    Set the --set-app-log-content-access parameter to true or false to disable or enable Log Monitoring:

    • Linux: ./oneagentctl --set-app-log-content-access=true
    • Windows: .\oneagentctl.exe --set-app-log-content-access=true

    Restart OneAgent service to apply changes.

    If Log Monitoring is unexpectedly disabled after a OneAgent upgrade, see Troubleshooting OneAgent installation.

OneAgent settings

Dynatrace Log Monitoring uses the OneAgent log module enabled by default with all OneAgent installations. While Log Monitoring does not require any specific configuration, you can modify some of the options available for the OneAgent log module.

You can adjust:

  • Enable and disable automatic log detection for different technologies.
  • Define default timezone in containers.
  • Enable defining the storage configuration by a configuration file on the host.
  • Define specific location where the timestamp and severity occur in your incoming log data.
  • Define the maximum number of log group instances per entity.

Global OneAgent settings for Log Monitoring

  1. Go to Settings > Log Monitoring > Advanced log settings.
  2. Adjust settings and Save changes.

Global OneAgent feature flags for Log Monitoring

  1. Go to Settings > Log Monitoring > Log Module Feature Flags.
  2. Adjust settings and Save changes.

Host-specific OneAgent settings for Log Monitoring

  1. Go to Hosts Hosts > Classic and select your host.
  2. On the host overview page, select More (…) > Settings in the upper-right corner of the page.
  3. On the Host settings page, select Log Monitoring and Advanced log settings.
  4. Adjust settings and Save changes.

Host-specific OneAgent feature flags for Log Monitoring

  1. Go to Hosts Hosts > Classic and select your host.
  2. On the host overview page, select More (…) > Settings in the upper-right corner of the page.
  3. On the Host settings page, select Log Monitoring and Log Module Feature Flags.
  4. Adjust settings and Save changes.

Default OneAgent settings

SettingDescriptionDefault

Detect open log files

This option automatically detects logs written by important processes.

enabled

Detect system logs

This option detects:

  • Linux: Syslogs and message logs.
  • Windows: System, application, and security event logs.

enabled

Detect logs of containerized applications

This option detects log messages written to the containerized application's stdout/stderr streams, including Kubernetes pod logs.

enabled

Detect IIS logs

This option detects logs and event logs written by the Microsoft IIS server.

enabled

Detect logs on network file systems

This option detects logs stored on the Network File System server. Applies for Linux only.

disabled

Allow OneAgent to monitor OneAgent logs

This option allows OneAgent to monitor its own logs.

disabled

Detect container time zones

This option enables automatic detection of the timezone in container logs when it's not defined in the log content or set manually.

enabled

Default timezone for agents

This option sets the default timezone for an agent when no more specific timezone configuration is set.

Local time zone

Timestamp search limit

This option sets the timestamp search limit.

64 bytes

Severity search chars limit

This option sets the severity search characters limit.

100 bytes

Severity search lines limit

This option sets the severity search lines limit.

2

Maximum number of log sources per process group instance

This option defines the maximum number of automatic log sources per entity; new automatic log sources won't be added once this limit is reached.

200

Windows Event log query timeout

This option defines the maximum timeout value, in seconds, for the query extracting Windows Event Logs.

5 seconds

Minimal log file size to perform binary detection

This option defines the minimum number of bytes in a log file required for binary detection.

512 bytes

Binary detection mode

This option specifies the granularity at which binary log files are detected. Per log source applies binary detection at the log source level; Per log file evaluates each log file individually.

Per log source

Feature flags for Log Monitoring

SettingDescriptionDefault

Collect all container logs

Enables OneAgent to collect all container logs in Kubernetes environments.1

enabled

Collect Journald logs

Enables OneAgent to collect logs from Journald on Linux systems. Enables detection of Journald logs and ensures logs that match an ingest rule are ingested.

enabled

Support for structured data in Windows Event Logs

Enables OneAgent to collect data from Event Logs in the User Data and Event Data sections.

disabled

Add IIS Application Pool context to Logs

Enables OneAgent to assign logs to the appropriate IIS application pools when an unambiguous IIS configuration is detected.

disabled

1

The matcher "Deployment name" in the log sources configuration will be ignored and needs to be replaced with "Workload name". Requires Dynatrace Operator 1.4.2 or later.

Configuration file Optional

The configuration file located on each OneAgent is used to set three options. For security reasons, these options can only be set on the host level and are available only by creating a JSON file in a specific location:

  • Linux: /var/lib/dynatrace/oneagent/agent/config/
  • Windows: %PROGRAMDATA%\dynatrace\oneagent\agent\config\

The configuration filename must have the json extension; the filename is otherwise unrestricted.

By default, these options are set for the OneAgent log module to operate properly and to auto-detect log files on the specific host. Modifying this configuration file is not required.

Multiple configuration files

You can have multiple JSON configuration files in the configuration folder. Files are evaluated in alphabetical order. Options from the last evaluated file takes priority.

Preexisting configuration files

If your OneAgent installation is upgraded, you may find a _migratedloganalytics.conf.json file that contains your configuration migrated from the ruxitagentloganalytics.conf on your host.

During installation, the OneAgent installer may create _loganalyticsconf.ctl.json, which will contain options used during the installation. The same file will be used to store relevant options set by the OneAgentCtl tool.

Available options

  • AppLogContentAccess
    Enables access to the log file content on this host. If set to false, the log file will be displayed in the user interface, but the content won't be accessible. Note that the OneAgent will still auto-detect log files unless the flag AppLogAutoDetection is set to false.

  • AppLogRemoteConfiguration
    Enables the manual configuration of logs to be accessed and monitored. If set to false, it won't be possible to add logs manually using the settings interface.

  • AppLogAutoDetection
    Enables auto-detection of log files on this host. If set to false, logs won't be auto-detected.

Example

{
  "agent-configuration": [
    {
      "AppLogRemoteConfiguration": true,
      "AppLogContentAccess": true,
      "AppLogAutoDetection": true
    }
  ]
}
Related tags
Logs Classic