Built-in log ingestion at Host Group and Host level

[rdobbs]

Good morning,

After doing a work session with our Product Specialist, there is a feature that we feel would be helpful for our platform.  We see the Built-in default log ingestion features that are listed at the Environment level, but that could be an issue where that can incur a significant amount of consumption should you have a significant number of hosts that are not currently reporting logs. 

By being able to narrow that down and override the settings at the host group and host level, you reduce the amount of manual entry in custom log settings at the host level and host group level if you just want to enable the built-in log reporting (i.e. Windows system logs, application logs, etc.) without having to put in custom paths for log ingestion for the categories that are already created in the platform but only available at the environment level. 

[AntonPineiro]

Hi,

I do not see your point. You can create log rules in host group or host level instead of environment level.

Best regards

[rdobbs]

Anton,

The point is that you should not have to manually build custom rules for features that are already built into the platform but are not available at each level.  These are standard log ingestion rules which Dynatrace already make available at the Environment level.  But say I do not want to blow my entire budget by turning it on for all of my hosts?  Now I have to go into each host group or potentially host that I want to do log monitoring on and write custom rules for something that Dynatrace already has written as a built in?  That's terribly inefficient.

[AntonPineiro]

Hi,

You can ingest a single log rule in tenant level adding host tags.

And then, adding that tag to your hosts. You have differents ways, but if you are already using Ansible or Puppet, it would be 1 minute using oneagentctl.

Best regards

[rdobbs]

Hi Anton,

Unfortunately we do not utilize an platform like Ansible or Puppet.  Our budget simply does not allow me to get that approved as I have asked for Ansible for the last two years.  

I agree, tagging could be utilized.  However, that is not a path that we utilize right now and Dynatrace has always provided multiple means to achieving these goals.  While tagging may fulfill the need if you are already tagging your hosts, I have 300+ that I have spread over 20+ management zones with 40+ host groups.  Not all of them fit neatly into the log ingestion needs that I know of now, or don't know until I start turning it on and determine what the impact is to my budget.  Having a simple means of being able to go into the host or host group and enabling/disabling default log ingestion through the UI without having to write a custom log rule or applying tags to apply custom log rules would make it much easier to determine the benefits of the log ingestion capabilities with GRAIL.  

I'm not saying that we couldn't do it with tagging, I just don't see the logic of having an all or nothing option for the built in rules when you need to use those rules just not on the whole environment at once.