This topic describes how to monitor and analyze log data by using LiveTail.

Prerequisites

Log data is collected by Logtail. For more information, see Use Logtail to collect data.
Notice LiveTail can monitor and analyze only the log data that is collected by Logtail.

Background information

In online O&M scenarios, you may need to monitor log data in real time and extract crucial information from the latest log data to troubleshoot exceptions. If you use a traditional O&M method, you must run the tail -f command on each server to query log data. If you want to narrow the scope of the command output, you must run the grep or grep -v command to filter the log data by keyword. To simplify online O&M operations, Log Service provides LiveTail in the Log Service console. You can use LiveTail in the Log Service console to monitor and analyze log data in real time.

Benefits

  • Log entries are monitored in real time and can be filtered by keyword.
  • Log entries are collected and indexed based on the collection configuration.
  • The content of log fields is segmented into words. The word segmentation feature allows you to query contextual log entries that contain specific words.
  • You can query a specified log entry from the log file that contains the log entry. This way, you can monitor the log entry in the log file in real time without the need to log on to a server.

Procedure

  1. Log on to the Log Service console.
  2. In the Projects section, click the name of the project that you want to view.
  3. Choose Log Storage > Logstores. On the Logstores tab, click the Logstore that you want to view.
  4. Click the Raw Logs tab. On the Raw Logs tab, click the Raw Data button. Then, click the LiveTail icon for a log entry to start LiveTail.
  5. In the LiveTail section, view log entries.
    After LiveTail is started, the log entries that are collected by Logtail are displayed in the LiveTail section in real time. By default, the latest log entries are displayed at the bottom of LiveTail section. You can view the latest log entries without the need to scroll down. A maximum of 1,000 log entries can be displayed. If more than 1,000 log entries are collected, the LiveTail section is automatically refreshed to display the latest 1,000 log entries. Analysis result generated by LiveTail

More operations

Operation Description
Highlight strings You can enter one or more strings in the Highlight field. The specified strings are highlighted in the LiveTail section.
Filter log entries by string You can enter one or more strings in the Filter By field. The LiveTail section displays only the log entries that contain the specified strings.
Filter log entries by field You can select one or more fields from the Filter by Field drop-down list. The LiveTail section does not display the log entries that contain the specified fields.
Stop LiveTail You can click Stop to stop LiveTail. After LiveTail is stopped, the LiveTail section is no longer refreshed. You can analyze the log entries in the LiveTail section to troubleshoot exceptions.