Simple Log Service:FAQ about Logtail

What is Logtail?

Logtail is a log collection agent that is provided by Simple Log Service. Logtail allows you to collect logs from different data sources to Simple Log Service. After you install Logtail on the server from which you want to collect logs, Logtail monitors the specified log files and uploads logs that are newly written to the log files to a specified Logstore.

Can Logtail collect data from static log files?

Logtail monitors modification events in the file system to determine whether log files are modified. If log files are modified, Logtail collects the logs that are generated in real time and sends the logs to Simple Log Service. If log files are not modified, Logtail does not collect data from the log files.

Which operating systems does Logtail support?

• Linux

  • x86-64 Linux operating systems:

    • Alibaba Cloud Linux 2

    • Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8

    • CentOS Linux 6, CentOS Linux 7, and CentOS Linux 8

    • Debian GNU/Linux 8, Debian GNU/Linux 9, Debian GNU/Linux 10, and Debian GNU/Linux 11

    • Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, and Ubuntu 20.04

    • SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12, and SUSE Linux Enterprise Server 15

    • openSUSE Leap 15.1, openSUSE Leap 15.2, and openSUSE Leap 42.3

    • Linux operating systems based on GNU C Library version 2.5 or later

  • ARM64 Linux operating systems:

    • Alibaba Cloud Linux 3.2 for ARM

    • Anolis OS 8.2 for ARM or later

    • CentOS Linux 8.4 for ARM

    • Ubuntu 20.04 for ARM

    • Debian GNU/Linux 11.2 for ARM

• Windows

  Note

  • If your server uses Windows Server 2008 or Windows 7, make sure that the operating systems run on x86 or x86_64.

  • If your server uses a different Windows operating system, make sure that the operating system runs on x86_64.

  • Microsoft Windows Server 2008

  • Microsoft Windows Server 2012

  • Microsoft Windows Server 2016

  • Microsoft Windows Server 2019

  • Microsoft Windows Server 2022

  • Microsoft Windows 7

  • Microsoft Windows 10

  • Microsoft Windows Server Version 1909

  • Microsoft Windows Server Version 2004

How do I install and upgrade Logtail?

• For more information about how to install Logtail, see Install Logtail on ECS instances, Install Logtail on a Linux server, Install Logtail on a Windows server, and Install Logtail components in a Kubernetes cluster.

• For more information about how to upgrade Logtail, see Upgrade Logtail on a Linux server, Upgrade Logtail on a Windows server, Upgrade Logtail components in an ACK cluster, and Upgrade Logtail components in a self-managed Kubernetes cluster.

  Important

  If Logtail is running, you must manually upgrade Logtail.

How do I configure Logtail to collect logs?

Simple Log Service allows you to collect text logs and container logs by using Logtail. You can also collect logs by using Logtail plug-ins. For more information, see the following topics:

• Collect text logs

• Collect container logs

• Collect logs by using Logtail plug-ins

How does Logtail collect logs?

Logtail collects logs in the following process: monitors log files, reads log files, processes logs, filters logs, aggregates logs, and sends logs. For more information, see Log collection process of Logtail.

Does Logtail support log file rotation?

Yes, Logtail supports log file rotation. For example, during log file rotation for the app.LOG file, the app.LOG.1 and app.LOG.2 files are generated. Logtail can detect the process of log file rotation and ensure that no logs are lost during this process.

How does Logtail handle network exceptions?

If a network error occurs or the write quota is exhausted, Logtail stops reading the logs that are being collected, keeps the log files open, and retries later.

What is the collection latency when Logtail collects logs?

Logtail collects logs based on the monitoring of modification events and sends the collected logs to Simple Log Service within three seconds.

How do I collect historical logs?

If the interval from the time when a log is generated to the system time when Logtail processes the log exceeds 5 minutes, the log is considered a historical log. By default, Logtail collects only incremental logs. If you want to collect historical logs, you can use the historical log import feature that is provided by Logtail. For more information, see Import historical logs from log files.

When does a Logtail configuration take effect after I modify it?

After you modify a Logtail configuration in the Simple Log Service console, the Logtail configuration takes effect within three minutes.

How do I resolve the issues that occur when Logtail collects logs?

You can perform the following operations to troubleshoot the issues. For more information, see What do I do if errors occur when I use Logtail to collect logs?

1. Check whether the heartbeat status of Logtail is OK.

2. Check whether the logs in the specified log files are generated in real time.

3. Check whether the regular expression in the Logtail configuration matches the content of the logs.