What is Logtail?

Logtail is a log collection agent that is provided by Log Service. Logtail allows you to collect logs from different data sources to Log Service. After you install Logtail on the server from which you want to collect logs, Logtail monitors the specified log files and uploads logs that are newly written to the log files to a specified Logstore.

Can Logtail collect data from static log files?

Logtail monitors modification events in the file system to determine whether log files are modified. If log files are modified, Logtail collects the logs that are generated in real time and sends the logs to Log Service. If log files are not modified, Logtail does not collect data from the log files.

Which operating systems does Logtail support?

  • Linux

    Logtail supports the following versions of 64-bit Linux x86 servers:

    • Alibaba Cloud Linux 2.1903
    • Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8
    • CentOS Linux 6, CentOS Linux 7, and CentOS Linux 8
    • Debian GNU/Linux 8, Debian GNU/Linux 9, and Debian GNU/Linux 10
    • Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, and Ubuntu 20.04
    • SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12, and SUSE Linux Enterprise Server 15
    • openSUSE Leap 15.1, openSUSE Leap 15.2, and openSUSE Leap 42.3
    • Linux operating systems based on Glibc 2.5 or later versions
  • Windows

    Logtail supports Microsoft Windows Server 2008 and Microsoft Windows 7 regardless of whether they use x86 or x86_64. Logtail supports other versions of Windows operating systems only if the operating systems use x86_64.

    • Microsoft Windows Server 2008
    • Microsoft Windows Server 2012
    • Microsoft Windows Server 2016
    • Microsoft Windows Server 2019
    • Microsoft Windows 7
    • Microsoft Windows 10
    • Microsoft Windows Server Version 1909
    • Microsoft Windows Server Version 2004

How do I install and upgrade Logtail?

How do I configure Logtail to collect logs?

Log Service allows you to collect text logs and container logs by using Logtail. You can also collect logs by using Logtail plug-ins. For more information, see the following topics:

How does Logtail collect logs?

Logtail collects logs in the following process: monitors log files, reads log files, processes logs, filters logs, aggregates logs, and sends logs. For more information, see Log collection process of Logtail.

Does Logtail support log file rotation?

Yes, Logtail supports log file rotation. For example, during log file rotation for the app.LOG file, the app.LOG.1 and app.LOG.2 files are generated. Logtail can detect the process of log file rotation and ensure that no logs are lost during this process.

How does Logtail handle network exceptions?

If a network error occurs or the write quota is exhausted, Logtail stops reading the logs that are being collected, keeps the log files open, and retries later.

What is the collection latency when Logtail collects logs?

Logtail collects logs based on the monitoring of modification events and sends the collected logs to Log Service within three seconds.

How do I collect historical logs?

If the interval from the time when a log is generated to the system time when Logtail processes the log exceeds 5 minutes, the log is considered a historical log. By default, Logtail collects only incremental logs. If you want to collect historical logs, you can use the historical log import feature that is provided by Logtail. For more information, see Import historical logs.

When does a Logtail configuration take effect after I modify it?

After you modify a Logtail configuration in the Log Service console, the Logtail configuration takes effect within three minutes.

How do I resolve issues that occur when Logtail collects logs?

You can use the following methods to resolve log collection issues. For more information, see Troubleshoot collection errors.

  1. Check whether the heartbeat status of Logtail is OK.
  2. Check whether the logs in the specified log files are generated in real time.
  3. Check whether the regular expression in the Logtail configuration matches the content of the logs.