LoongCollector is the log collection agent for Simple Log Service (SLS). To collect logs from Linux servers, you must first install LoongCollector on them.
Limitations
Prerequisites
Choose an installation method
Installation method | Scenario |
The server is an ECS instance in the same account and region as the project. | |
The server is an ECS instance in the same account as the project but in a different region. | |
The server is an ECS instance in the same region as the project but in a different account. | |
|
Same account and region
If your ECS instance and project are in the same account and region, you can use one-click installation. SLS uses OOS to automate the installation, so you do not need to log on to the instance manually.
The one-click installation feature is integrated into the data collection templates of SLS. SLS provides various text log templates, such as single-line, multi-line, and regex-based templates. These templates differ only in their processing plug-ins. You can add or remove processing plug-ins within a template. Select a template based on the characteristics of the logs that you want to collect, or select any text log template and then configure the processing plug-ins based on your log characteristics.
Procedure
Log on to the SLS console. In the project list, click your desired project.
In the left-side navigation pane, choose
Log Storage > Logstores. Click the
icon next to the name of your desired Logstore.Click the
icon next to Data Collection, select the Single-line - Text Log import template in the pop-up dialog box, and click Integrate Now.Click Create Machine Group. Select one or more ECS instances that are in the same region as the project, and then click Install and Create Machine Group.
Wait for the installation to complete, enter a name, and then click OK. If the installation fails, click Recreate Installation Task and reselect the ECS instances. Make sure that the selected ECS instances are in the same region as the project.
Click Next. If the heartbeat status is FAIL, click Automatic Retry and wait for about two minutes until the status changes to OK.
The one-click installation is complete. Click Next to create a collection configuration.
Same account, different region
If the server is an Alibaba Cloud ECS instance, and the instance and project belong to the same Alibaba Cloud account but are in different regions, you must manually download the installation package and use data transmission over the internet or transfer acceleration in the installation command.
Procedure
Download the installation package. Run the download command on the server. In the sample code, you can replace
${region_id}withcn-hangzhou. To accelerate the download, replace${region_id}with the Region ID of the region where the ECS instance resides.wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;Select a transmission method and run the installation command. Replace
${region_id}with the Region ID of the region where the project resides.Internet: This method is suitable for most scenarios, such as cross-region deployments and data collection from other cloud platforms or on-premises servers. However, it is subject to bandwidth limits and potential instability.
chmod +x loongcollector.sh; ./loongcollector.sh install ${region_id}-internetTransfer acceleration: This method is used for cross-region data transmission, such as from a region in the Chinese mainland to a region outside the Chinese mainland. It uses Content Delivery Network (CDN) to accelerate data transmission and improve performance, which avoids high latency and instability over the internet. However, this method incurs data transfer fees.
You must enable the cross-region transfer acceleration feature for the project before you run the installation command.
chmod +x loongcollector.sh; ./loongcollector.sh install ${region_id}-acceleration
Check the startup status. If
loongcollector is runningis returned, the agent is started.sudo /etc/init.d/loongcollectord statusConfigure a machine group. SLS uses machine groups to discover custom identifiers and establish heartbeat connections with LoongCollector on hosts.
On the server, write a custom string such as
user-defined-test-1to the custom identifier file. This string will be used in a later step.# Write a custom string to the specified file. If the directory does not exist, create it manually. The file path and name are fixed by SLS and cannot be changed. echo "user-defined-test-1" > /etc/ilogtail/user_defined_idLog on to the SLS console. In the project list, click your desired project.
In the left-side navigation pane, choose
Resources > Machine Groups.Click the
icon next to Machine Groups, and then click Create Machine Group.Configure the following parameters and click OK.
Machine Group Name: Enter a name for the machine group. It must be unique within the project, 3 to 128 characters long, start and end with a lowercase letter or a digit, and contain only lowercase letters, digits, hyphens (-), and underscores (_).
Machine Group Identifier: Select Custom Identifier.
Custom identifier: Enter the identifier that matches the custom string in the custom identifier file on the server. For example,
user-defined-test-1.
After the machine group is created, click the target machine group in the machine group list to check the Heartbeat status. If the status is FAIL, wait about two minutes and then manually refresh. A status of OK means the machine group was created successfully.
After installation, create a collection configuration to collect logs.
Different accounts in the same region
If your server is an Alibaba Cloud ECS instance, and the instance and the project are in the same region but belong to different Alibaba Cloud accounts, you must manually download the installation package. Use the internal network transmission method in the installation command and configure a user ID.
Follow these steps:
Download the installation package. Run the download command on the server. In the sample code, you can replace
${region_id}withcn-hangzhou. To speed up the download, see Region ID and replace${region_id}with the region of the ECS instance.wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;Run the installation command. Replace
${region_id}with the Region ID of the project.If a connection timeout occurs, you may have used the wrong
${region_id}. The internal network cannot establish a connection between different regions. Correct the Region ID and run the installation command again.chmod +x loongcollector.sh; ./loongcollector.sh install ${region_id}Check the startup status. Run the command. If
loongcollector is runningis returned, the startup is successful.sudo /etc/init.d/loongcollectord statusConfigure the user ID. The user ID file contains the ID of the root Alibaba Cloud account that owns the project. This ID indicates that the account has permission to access and collect logs from this server.
You only need to configure a user ID when you collect logs from ECS instances under another account, self-managed servers, or servers from other cloud providers. If multiple accounts collect logs from the same server, you can create multiple user ID files on that server.
Log on to the SLS console. Hover the pointer over your profile picture in the upper-right corner. In the tab that appears, view and copy the account ID. Make sure to copy the root account ID.
On the server where LoongCollector is installed, create a user ID file. Use the root account ID as the filename.
touch /etc/ilogtail/users/{Alibaba Cloud Account ID} # If the /etc/ilogtail/users directory does not exist, create it manually. The user ID file requires only a filename and no file extension.
Configure a machine group. SLS uses the machine group to discover the custom identifier and establish a heartbeat connection with LoongCollector on the host.
On the server, write the custom string
user-defined-test-1to the custom identifier file. This string is used in a later step.# Write a custom string to the specified file. If the directory does not exist, create it manually. # The file path and name are fixed by SLS and cannot be changed. echo "user-defined-test-1" > /etc/ilogtail/user_defined_idLog on to the SLS console. In the project list, click the target project.
Click
Resources, and then click Machine Groups.To the right of the Machine Groups list, click the
icon, and then click Create Machine Group. You can also click the four-square icon in the upper-right corner and select Create Machine Group from the drop-down menu.Configure the following settings and click OK.
Set Machine Group Name: The name must be unique within the project. The name must be 3 to 128 characters in length. It must start and end with a lowercase letter or a digit, and can contain only lowercase letters, digits, hyphens (-), and underscores (_).
Set Machine Group Identifier: to Custom Identifier.
Custom Identifier: Enter the custom identifier that you configured. This identifier must be the same as the custom string in the custom identifier file on the server. In this example, the identifier is
user-defined-test-1.
After the machine group is created, click the target machine group in the list. In the machine group status section, check the Heartbeat status. If the status is FAIL, wait about two minutes and then refresh the page. If the heartbeat status is OK, the machine group is successfully created.
After the installation is complete, you must create a collection configuration to collect logs.
Other cloud or on-premises servers
If your server is hosted on another cloud platform or is an on-premises server, you must manually download the installation package. Use the public network or transfer acceleration method in the installation command and configure a user ID. An Alibaba Cloud ECS instance is also considered an on-premises server if the instance and the project belong to different Alibaba Cloud accounts or are in different regions.
For server usage limits, see Supported Linux distributions.
Procedure
Download the installation package. Run the download command on your server. In the sample code, you can replace
${region_id}withcn-hangzhou. To accelerate the package download, see Region ID and replace${region_id}with the region ID of your ECS instance.wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;Choose a transfer method and run the installation command. Replace
${region_id}with the Region ID of the region where your project is located.Public network: This method works for most scenarios, including cross-region transfers and servers on other clouds or on-premises. However, it is subject to bandwidth limits and potential instability.
chmod +x loongcollector.sh; ./loongcollector.sh install ${region_id}-internetTransfer acceleration: Use this for cross-region transfers, such as from mainland China to overseas regions. It uses CDN acceleration to improve performance and avoid the high latency and instability of the public network. This traffic incurs additional charges.
Enable the cross-region log transfer acceleration feature for your project before you run the installation command.
chmod +x loongcollector.sh; ./loongcollector.sh install ${region_id}-acceleration
Check the startup status. Run the command. If
loongcollector is runningis returned, the startup is successful.sudo /etc/init.d/loongcollectord statusConfigure the user ID. The user ID file contains the ID of the Alibaba Cloud root account that owns the project. This ID verifies that the account has permission to access and collect logs from this server.
Configure a user ID only when collecting logs from an ECS instance not under your account, an on-premises server, or a server from another cloud provider. If multiple accounts collect logs from the same server, you can create multiple user ID files on it.
Log on to the SLS console. Hover over your user avatar in the upper-right corner. In the tab that appears, view and copy the account ID. Make sure to copy the root account ID.
On the server where LoongCollector is installed, create a user ID file. Use the root account ID as the filename.
touch /etc/ilogtail/users/{Alibaba Cloud Account ID} # If the /etc/ilogtail/users directory does not exist, create it manually. The user ID file only needs a filename and does not require a file extension.
Configure a machine group. SLS uses the machine group to discover the custom identifier and establish a heartbeat connection with LoongCollector on the host.
On the server, write the custom string
user-defined-test-1to the custom identifier file. This string will be used in a later step.# Write the custom string to the specified file. If the directory does not exist, create it manually. The file path and name are fixed by SLS and cannot be customized. echo "user-defined-test-1" > /etc/ilogtail/user_defined_idLog on to the SLS console. In the project list, click the target project.
Click
Resources, and then click Machine Groups.To the right of Machine Groups, click
, and then click Create Machine Group.Configure the following settings and click OK.
Machine group name: The name must be unique within the project. It must be 3 to 128 characters long, start and end with a lowercase letter or a digit, and contain only lowercase letters, digits, hyphens (-), and underscores (_).
Machine Group Identifier: Select Custom Identifier.
Custom Identifier: Enter the configured custom identifier. It must match the custom string in the custom identifier file on the server. In this example, the value is
user-defined-test-1.
After the machine group is created, click it in the machine group list. In the machine group status panel, check the Heartbeat status. If the status is FAIL, wait about two minutes and refresh the page. A status of OK means the creation was successful.
After installation, create a collection configuration to collect logs.
Install LoongCollector in batches
The automatic installation feature supports selecting multiple ECS instances when the instances and the project are in the same account and region.
In other scenarios, use ECS Cloud Assistant to run commands as temporary tasks. This lets you run LoongCollector installation commands in batches on ECS instances.
For download and installation commands, see the installation scenarios described previously. To learn how to use ECS Cloud Assistant, see Create and run commands.
Upgrade and rollback
LoongCollector stops running during an upgrade and automatically starts after the upgrade is complete. The upgrade overwrites only necessary files. Configuration files and checkpoint files are retained to ensure that no logs are lost during the upgrade.
Upgrade LoongCollector or upgrade Logtail to LoongCollector
Run the download command on the server to get the latest installation package. In the example code, replace
${region_id}with a region ID such ascn-hangzhou. To speed up the package download, see Regions and replace${region_id}with the region where your ECS instance is located.wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;Run the upgrade command. Use the
upgradecommand to upgrade. If you use theinstallcommand, it performs an overwrite installation, and your original configuration will be lost.chmod +x loongcollector.sh; sudo ./loongcollector.sh upgrade;If the following information is displayed, the upgrade is successful.
Upgrade loongcollector files successfully. Starting loongcollector ... Upgrade loongcollector successfully.
Roll back LoongCollector to Logtail
Download the logtail.sh script again. Do not use the previous version of the script.
Run the download command on the server to get the installation package. In the example code, replace
${region_id}with a region ID such ascn-hangzhou. To speed up the package download, see Regions and replace${region_id}with the region where your ECS instance is located.wget https://logtail-release-${region_id}.oss-${region_id}.aliyuncs.com/linux64/logtail.sh -O logtail.sh;Run the rollback command. To specify a version, such as 1.8.7, see the commented line and replace the version number as needed.
chmod +x logtail.sh; sudo ./logtail.sh upgrade; #chmod +x logtail.sh; sudo ./logtail.sh upgrade -v 1.8.7;
Install a specific version
Use the -v parameter to install a specific version. See the following commands and replace the version number as needed.
LoongCollector
chmod +x loongcollector.sh; sudo ./loongcollector.sh install ${region_id} -v 3.2.6;Logtail
chmod +x logtail.sh; sudo ./logtail.sh install ${region_id} -v 1.8.7;
Uninstall LoongCollector
In the example code, replace
${region_id}with a region ID such ascn-hangzhou. To speed up the execution, see Regions and replace${region_id}with the region where your ECS instance is located.wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh;Run the uninstall command.
chmod +x loongcollector.sh; sudo ./loongcollector.sh uninstall;
Frequently asked questions
Install LoongCollector on a server without an internet connection
On the server where you want to install
LoongCollector, rununame -mto check the system architecture. Then, on a server with internet access, run the corresponding download command. Replace${region_id}with the Region ID of your project.ARM architecture:
wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh;wget http://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/aarch64/main/loongcollector-linux64.tar.gz;x86-64 architecture:
wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh;wget http://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/x86_64/main/loongcollector-linux64.tar.gz;
Copy the downloaded installation script and package to the server where you want to install
LoongCollector. Then, run the following command. Replace${region_id}with the Region ID of your project.chmod +x loongcollector.sh; ./loongcollector.sh install-local ${region_id}-internetRun the status command. If the output is
loongcollector is running, LoongCollector has started successfully.sudo /etc/init.d/loongcollectord statusBecause the server cannot access the internet, you must also establish a connection by configuring a proxy.
Upgrade LoongCollector on a server without an internet connection
On the server where you want to upgrade
LoongCollector, rununame -mto check the system architecture. Then, on a server with internet access, run the corresponding command. Replace${region_id}with the region of your project.ARM architecture:
wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh;wget http://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/aarch64/main/loongcollector-linux64.tar.gz;x86-64 architecture:
wget https://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh;wget http://aliyun-observability-release-${region_id}.oss-${region_id}.aliyuncs.com/loongcollector/linux64/latest/x86_64/main/loongcollector-linux64.tar.gz;
Copy the installation script and package to the server where you want to upgrade
LoongCollector. Then, run the following command:chmod +x loongcollector.sh;./loongcollector.sh upgrade-local;
One-click installation fails
Automatic installation is supported only when the ECS instance and the project are in the same account and region. If this is not your case, use a different installation method. If your setup meets this requirement, check if you have met the permission and network requirements. For more information, see Prerequisites.
Resolve a missing or failed heartbeat
If the heartbeat status is FAIL, it might be because the initial connection takes time. Wait about two minutes, then refresh the status. If the status is still FAIL, follow these steps to troubleshoot:
Confirm the relationship between the server and the SLS project. The installation procedure varies based on this relationship.
If you used the wrong procedure, run the
chmod +x loongcollector.sh; sudo ./loongcollector.sh uninstall;command on the server to uninstall. Then, repeat the installation using the correct procedure.
If you used the correct procedure but the heartbeat status is still FAIL, check the server where LoongCollector is installed. Verify that the
regionin the/usr/local/ilogtail/ilogtail_config.jsonfile matches the Region ID of your SLS project.If they do not match, replace ${region_id} in the installation command with the correct Region ID and run the command again. LoongCollector will update the file.
This action overwrites the existing installation and deletes your original configurations. Use this method with caution on servers that are already configured for collection.
If the information is correct, or if the heartbeat status is still FAIL after you reinstall, proceed to the next step.
If your procedure involves a cross-account scenario that requires a user ID file, check the following:
The user ID must be the ID of the root account. If it is not, change it.
The root account ID must belong to the account that owns the SLS project, not the account that owns the ECS server.
Check the custom identifier configured for the machine group in the SLS console. Ensure it matches the content of the custom identifier file on the server. If they do not match, modify either the console configuration or the file to make them identical.
If the heartbeat status is still FAIL, check if you have met the network requirements. For more information, see Prerequisites.
Related references
Regions
Log on to the SLS console. In the project list, click the target project.
Click the
icon to the right of the project name to go to the project overview page.In the Basic Information section, view the region name of the current project. See the table below for the corresponding Region ID.
A region represents the geographical location of a physical data center for cloud resources. A Region ID is the unique identifier for a cloud service region.
LoongCollector network transfer types
An endpoint is the access domain name for SLS. It is the URL used to access a project and its log data. The endpoint is specific to the region where the project is located. SLS provides private endpoints, public endpoints, and transfer acceleration endpoints. View the endpoints as follows:
Log on to the SLS console. In the project list, click the target project.
Click the
icon to the right of the project name to go to the project overview page.In the Access Endpoints section, view the endpoint information for the current project. Different network transfer methods correspond to different endpoints. Choosing the right network transfer method helps ensure faster and more stable log data transmission.
Network type | Corresponding endpoint type | Description | Scenarios |
Alibaba Cloud internal network | Private endpoint | The Alibaba Cloud internal network is a gigabit shared network. Transferring log data over the internal network is faster and more stable than over the public internet. The internal network includes VPC and the classic network. | The ECS instance and the SLS project are in the same region, or you have connected your on-premises server to the internal network. Note Create an SLS project in the same region as your ECS instance. This lets you collect logs from the ECS instance over the Alibaba Cloud internal network without consuming public bandwidth. |
Public internet | Public endpoint | When you transfer log data over the public internet, the speed and stability of data collection can be affected by bandwidth limits, network jitter, latency, and packet loss. | Transfer data over the public internet in the following two cases.
|
Transfer acceleration | Transfer acceleration endpoint | Using Alibaba Cloud CDN edge nodes to accelerate log collection offers significant advantages in network latency and stability compared to collection over the public internet, but the traffic incurs additional charges. | If your application server and SLS project are in Chinese and international regions respectively, transferring data over the public internet may cause high latency and instability. Use transfer acceleration to transfer data in this case. For more information, see Transfer acceleration. |