Logtail FAQ - Simple Log Service - Alibaba Cloud Documentation Center

Find answers to frequently asked questions about Logtail, organized by category.

Category		Related documentation
Basic concepts		Basic questions about Logtail Comparison of log collection agents
Heartbeat issues		Troubleshoot machine group issues for Logtail (host scenarios)
Collection issues	General scenarios	Query the local collection status How to view Logtail collection error messages Troubleshoot Logtail log collection failures How do I troubleshoot logs that exist in a LogStore even though Logtail is not configured? Common error types for data collection in Simple Log Service How to collect logs from a file multiple times
	Container scenarios	How to troubleshoot exceptions in container log collection
Deployment and management issues	General scenarios	The IP address is empty in the app_info.json file of the Logtail service How to update machine group configurations after switching an ECS instance from the classic network to a VPC How to collect logs from servers in a corporate intranet Logtail automatic diagnosis tool
	Windows scenarios	An exception message appears in the service log when you install Logtail on a Windows instance
	Container scenarios	How to collect container logs from a Kubernetes cluster
Log format parsing issues		Debugging regular expressions How to optimize the performance of a regular expression How to collect logs in multiple formats
Error codes		Common error types for data collection in Simple Log Service

How do I troubleshoot logs that exist in a LogStore even though Logtail is not configured?

If you see logs in a LogStore but have not configured Logtail collection for it, the logs were most likely written through one of the following paths:

Data written directly by an SDK: An SDK, such as the Aliyun Log Java Producer, can call the PutLogs API to write logs directly to a LogStore. This does not require Logtail. To confirm this, go to the log query page and check the Method field. A value of PostLogStoreLogs indicates that the log was written by an SDK instead of Logtail. You can further check the UserAgent field to identify which SDK was used, for example, aliyun-log-python-sdk. Before you query these fields, make sure that indexing is enabled for the LogStore.
Multiple Logtail configurations matching the same file: If more than one Logtail configuration collects the same log file, the MULTI_CONFIG_MATCH_ALARM alert is triggered, which can also explain why logs appear without an obvious matching collection configuration. For the troubleshooting steps and the solution, see Use CloudLens to troubleshoot duplicate file configuration issues in iLogtail (MULTI_CONFIG_MATCH_ALARM).