topic Load on OneAgent when a large amount of logs are ingested by OneAgent in Log Analytics

Load on OneAgent when a large amount of logs are ingested by OneAgent

Shirai — Thu, 19 Jun 2025 06:51:36 GMT

I understand that if a large amount of log files are ingested by OneAgent, a DPS license will be consumed.

Do I need to consider the load on OneAgent, which ingests logs and sends information to the SaaS tenant? Will the load on OneAgent increase if it ingests a large amount of logs?

I don't think there is any mention in the Dynatrace documentation about the load caused by OneAgent's log ingest.

Re: Load on OneAgent when a large amount of logs are ingested by OneAgent

GerardJ — Thu, 19 Jun 2025 07:43:26 GMT

Sure you have to consider that. I have previously encountered a situation where resource consumption of log analytics module server was very high. I had to work with support to finely adjust the parameters to effectively collect logs while limiting CPU usage. As far as I remember, this was more due to the directory structure and the number of files in these directories than the volume of logs to be ingested.

Re: Load on OneAgent when a large amount of logs are ingested by OneAgent

y_buccellato — Thu, 19 Jun 2025 10:37:32 GMT

Hello @Shirai I can confirm the experience shared by @GerardJ .

Directory structure and amount of file contain in it was the main challenge and reason the oneagent log module was consuming a lot of resource on vm. But I remember that after toping at some consumption level basically the module was killing itself and then starting back again.

Re: Load on OneAgent when a large amount of logs are ingested by OneAgent

Shirai — Fri, 20 Jun 2025 00:21:42 GMT

@y_buccellato @GerardJ Thank you for your comment.

Log files are rotated daily based on file size, and there are often many files in the same directory or in directories under it.

Re: Load on OneAgent when a large amount of logs are ingested by OneAgent

Shirai — Fri, 20 Jun 2025 01:43:32 GMT

I'm thinking maybe I can work around the issue by turning off auto-detection of log files and configuring a custom log source, but I have no evidence to support this.