topic Re: Not able to ingest application log files using OneAgent on a Fargate container in Log Analytics

Not able to ingest application log files using OneAgent on a Fargate container

paul2perth — Tue, 18 Jun 2024 07:09:31 GMT

I have deployed OneAgent onto my Fargate container which is primarily running nginx and Flask/Python with uWSGI.

The container shows as a host through Hosts Classic fine.

The application log file is written to /var/log/app/ as action.log which should meet the security criteria.
The container root file system is read-only.
A number of volumes and mount points have been added for
- logging nginx and uWSGI,
- OneAgent logs and datastorage,
- /tmp and
- /var/log/app directory structure.

Under the host I'm not seeing any automatically detected logs so have tried to add /var/log/app

I have added

A custom log source, against the nginx log source context and path /var/log/app/*
A log ingest rule for /var/log/app/action.log

Despite this I am still not able to see the logs being ingested in Logs & Events.

I do have logs ingesting from my EC2 hosts without issue.

Any help would be welcome.

Cheers

PacoPorro — Tue, 18 Jun 2024 07:22:32 GMT

With fargate you should go through fluent bit

ASE — Thu, 03 Oct 2024 02:18:23 GMT

This behavior sounds very similar to what we're experiencing with our ECS/Fargate Containers.

When I view an ECS/EC2 Cluster in the Hosts app, it automatically detects all available Log Sources.

But when I view an ECS/Fargate Cluster in the Containers app, it does not automatically detect all available Log Sources.

Both configs have OneAgent installed.

The issue could be related to us using ECS/Fargate. 🤔

Perhaps the info provided to me can help you with your troubleshooting: