Log content auto-discovery
By default, Dynatrace automatically discovers all new log files that meet the requirements described below.
Dynatrace auto-discovers, analyzes, and stores logs every 60 seconds. You can modify this frequency in the Log Monitoring configuration file.
By default, log files are auto-discovered and analyzed if they are in:
Windows System Log
Windows Security Log
Windows Application Log
A log file must meet all of the following requirements in order to be auto-discovered:
The log file must be opened by an important process.
The log file must exist for a minimum of one minute.
The log file must contain a supported time stamp.Binary logs and unsupported time stamp
Binary log files and log files that contain an unsupported time stamp will be detected automatically but will not be analyzed.
The log file must be at least 0.5 KB in size.
The log file must have been updated (written to) in the last 7 days.
Log files that have not been updated in the past 7 days while log monitoring is active will not be visible on dashboards.
The log file must be in the actual
logsfolder or in its subfolders:
- Valid path examples:
- Invalid path example:
or the log filename must contain a
logstring preceded or followed by the period (
.) or underscore (
- Valid filename examples:
- Invalid filename example:
- Valid path examples:
Additional limitations for automatically detected files
- File cannot be deleted earlier than a minute after creation.
- Files must be appended (old content is not uploaded).
- Files must have text content.
- Log files must be opened constantly (not just for short periods of adding log entry).
- Log files must be opened in write mode.
What might prevent logs to appear on the server?
Over 200 rotated log file groups are detected for a process.
Dynatrace detects a rotation scheme for log files and reports all the log files in the detected scheme as a group under one name, which typically maps to many files on disk. A large number of rotated file groups typically means that Dynatrace did not recognize the rotation pattern correctly and reports each physical file separately as a group. Once 200 reported rotated log file groups is reached, auto detection is turned off for this process. To resolve this issue, you can:
The files are growing very quickly.
When a log file grows very quickly (at a pace over 10 MB/s), its content might be skipped. OneAgent will continue to send the log file as long as both the network and the server can handle the load. Note that 10 MB/s with typical compression is approximately 10 Mbps of upload traffic.
The file name or path doesn't match typical log naming.
OneAgent checks whether logs match a file name and path pattern that is typical for log files. If there is no match, the file will not be reported and sent to the server. This is needed to avoid false positives on detection of files as logs, and to prevent pulling non-log data from hosts. To remedy this, you can set rules in the OneAgent configuration,
AutomaticFileproperty (Log Monitoring configuration file).
There are symbolic links in the file or the paths.
This limitation applies to custom files that point to a path that contains symbolic links. The physical path of the file pointed to by a symbolic link must meet the criteria for a log. Otherwise, symbolic links could be used to read non-log data from a host.
The file size is below
Turn off log auto-discovery
If you don't want Dynatrace to automatically discover new log files on a specific monitored host, you can turn off log auto-discovery.
- On the host, open the log analytics configuration file for editing.
- On Linux:
- On Windows:
- On Linux:
- Set the following:
AppLogAutoDetection = false
OneAgent restart is not required.