Logs Classic - Log storage configuration vs Custom log source

[AntonPineiro]

Hi,

I do not understand if both are required to configure a custom path in a Linux server.

1. Is log storate new one and custom log source legacy one?
2. Both configurations are required to configure a custom path?

Thank you so much!

Best regards

[Mohamed_Hamdy · Accepted solution]

Hi @AntonPineiro,

The custom log storage which related to the logs that are not detected automatically by OneAgent, so you can specify the log source path. after adding the customized log source path you need to create another rule in the Log storage configuration to include/enable this custom log source and to be monitored.

as for other log files that are automatically detected by OneAgent, you can create log monitoring configurations directly without creating any custom log source.

so yes both are required to configure custom log path, the first step to configure the custom log path and the second step is to include/enable monitoring for this custom log.

I hope this helps you and let me know if further clarifications are needed.

[Taylor-Sanchez · Accepted solution]

Hi @AntonPineiro , 

In response to your first question, there is no 'new' or 'legacy' in terms of log storage and the custom log source. Both are required in order for you to be able to detect a log that is not natively discovered by Dynatrace, as described by @Mohamed_Hamdy . 

In addition, the documentations required for you to be able to do both can be found here, where it specifies that it must be done in two parts. Attaching the screenshot as well for visibility,
https://www.dynatrace.com/support/help/shortlink/log-monitoring-custom-source

[AntonPineiro]

Hi,

Thank you both. It is strange, I have just only created a log storage configuration (without log source configuration) and logs are being ingested.

It is in relation to Windows Application Logs, maybe for Linux both rules are required.

Best regards

[Julius_Loman · Accepted solution]

@AntonPineiro you definitely need log storage configuration (rules about what to ingest). If the log file is autodetected (windows event logs, standard linux log paths such as /var/log/syslog or any logs detected automatically (you can see them on the process group instance screen), then you don't need any custom log source rules.

There is an exception - custom log source are still required for AIX for any logs. Autodetection is not working for AIX. Also if you still cannot see any entries, be sure to check loganalytics logs from the agent. It's not uncommon for the custom path to be blocked by security rules which can be overridden in the OneAgent configuration file.