Log Analytics, auto detection disabled, can't remove old logs

[mike_prior]

Hi,

I would like to manually control which log folders are monitored, and have set

AppLogAutoDetection=false in ruxitagentloganalytics.conf, but I can't get the auto detected logs to disappear from the DTSAAS GUI. I removed the oneagent and all dynatrace directories, and reinstalled the agent, but the auto-detected logs still show up. Is there a way to get dtsaas to remove an old server completely, after uninstalling the agent on a server? Also one application creates a log file for each job it runs, and I would only like to keep the past 2 days or x number of events in the GUI for a process. The FilesInGroup settings may be a way to do this?

#FilesInGroup=Process Group Id, warning number of files, maximum number of files
#FilesInGroup=0x0, 150, 200

Thanks

Mike

[pawel_brzoska · Accepted solution]

Hi Mike,

log files that are no longer monitored will disappear from log viewer after 72h of inactivity. As for your log file for each job use case, i'd suggest adding this as a rotated fileset. For example, if these logs look like:

/var/log/app/job-123456.log

/var/log/app/job-123457.log

/var/log/app/job-123458.log

you can add them as

/var/log/app/job-#.log and then a single virtual file log entry will point to all of them.

The option you mention above is not for this scenario. It actually disables auto-discovery for process groups that have more than 200 different log files.

[mike_prior]

Thanks Pawel, I'll try that.

Mike