Not able to ingest application log files using OneAgent on a Fargate container

[paul2perth]

I have deployed OneAgent onto my Fargate container which is primarily running nginx and Flask/Python with uWSGI.

The container shows as a host through Hosts Classic fine.

• The application log file is written to /var/log/app/ as action.log which should meet the security criteria.
• The container root file system is read-only.
• A number of volumes and mount points have been added for
  • logging nginx and uWSGI,
  • OneAgent logs and datastorage,
  • /tmp and
  • /var/log/app directory structure.

Under the host I'm not seeing any automatically detected logs so have tried to add /var/log/app

I have added

• A custom log source, against the nginx log source context and path /var/log/app/*
• A log ingest rule for /var/log/app/action.log

Despite this I am still not able to see the logs being ingested in Logs & Events.

I do have logs ingesting from my EC2 hosts without issue.

Any help would be welcome.

Cheers

[PacoPorro · Accepted solution]

With fargate you should go through fluent bit

https://docs.dynatrace.com/docs/observe-and-explore/logs/lma-log-ingestion/lma-log-ingestion-via-api...

[ASE]

Hello, @paul2perth.

This behavior sounds very similar to what we're experiencing with our ECS/Fargate Containers.

When I view an ECS/EC2 Cluster in the Hosts app, it automatically detects all available Log Sources.

But when I view an ECS/Fargate Cluster in the Containers app, it does not automatically detect all available Log Sources.

Both configs have OneAgent installed.

The issue could be related to us using ECS/Fargate. 🤔

Perhaps the info provided to me can help you with your troubleshooting:

https://community.dynatrace.com/t5/Container-platforms/Container-Logs-Not-Found-Containers-App/m-p/2...