topic Log file not being detected. in Log Analytics

Log file not being detected.

Maheedhar_T — Tue, 12 Nov 2024 13:13:31 GMT

We are having a strange issue. We have two log files in same path /tmp/tmp_Voice.log and /tmp/tmp_Data.log we configured log ingestion rules and custom log sources for both the files but only the log from /tmp/tmp_Voice.log is being ingested where as no log record from tmp_Data.log is monitored just to verify we renamed the tmp_Voice.log to tmp_XYZ.log and tmp_Data.log to tmp_Voice.log and then tried ingesting some log record. It is working as expected I mean we are seeing original tmp_Data.log related log when it is renamed to tmp_Voice.log so the issue is not with log format either. Not sure where to debug this issue. Is the file name a problem ?

Re: Log file not being detected.

p_devulapalli — Thu, 07 Nov 2024 23:07:45 GMT

@Maheedhar_T - Start by looking at the Log Ingest Rules and Custom Log Source Configuration, can you share a snap of how you have set it up?

Are you using any wildcards , if yes make sure they are matching correctly and check if the rule that you have created is not merging both the log files into single source file

Re: Log file not being detected.

Maheedhar_T — Fri, 08 Nov 2024 05:51:01 GMT

No @p_devulapalli ,
We are not using any wildcards.

This is what we configured. We tried changing the file name from tmp_Data.log to tmpData.log and that isn't working either.

Re: Log file not being detected.

Peter_Youssef — Fri, 08 Nov 2024 06:06:29 GMT

Hello @Maheedhar_T

Kindly review the log monitoring related docs against the raised inquiry and current configurations:

Make sure that the the latest version of Dynatrace log monitoring is enabled for the environment.
For auto Discovery scenarios : log-content-auto-discovery-v2
Custom Log sources: log-custom-source
On the CMC check If you find logs have been trimmed > It's recommendned to increase the allocated storage.
Make sure Maximum ingest of Log Events is properly configured to the maximum as per the cluster sizing.

Hoping it helps.

KR,

Peter