Troubleshooting

observIQ Log Agent

When troubleshooting issues with the log agent it is important to review the logs. These can help diagnose issues. Below is the default install paths and log locations. You have a couple of options to view the files. You can install the observIQ Agent source. This will allow you to view the agent logs within observIQ. Another option is to view the logs manually on the host.

observIQ Agent Source

You can view the agent log in observIQ using the observIQ Agent source. This can help diagnosing issues with the log agent without manually reviewing logs on the host. Details on how to install a source can be found here.

Manual Agent Troubleshooting

In cases when you do not want to use the observiq Agent source or are unable to use it you will need to locate the logs on the host to review them. The following paths will point you in the right direction.

observIQ Agent Install Paths

/opt/observiq-agent/
C:\observiq-agent
/Users/<user>/observiq-agent

observIQ Agent Logs Path

/opt/observiq-agent/log/
C:\observiq-agent\log
/Users/<user>/observiq-agent/log

Set Logs to Debug

It can be helpful to put the logs into debug mode for troubleshooting. To do this you will need to set the log level to DEBUG in the logging.yaml file. You can find the logging.yaml in the config folder of the observIQ Agent.

logging.yaml Locations

/opt/observiq-agent/config/logging.yaml
C:\observiq-agent\cofnig\logging.yaml
/Users/<user>/observiq-agent/config/logging.yaml

logging.yaml Settings

level: INFO
max_backups: 5
max_megabytes: 1
max_days: 7
level: DEBUG
max_backups: 5
max_megabytes: 1
max_days: 7

Source

If the agent is setup and has started without issue. Then it is possible the source configuration isn't correct. With some common cases this may be the log file location is incorrect. You can see if that is the case by looking at the logs to see if it started watching the file or got an error the file is not found.

When using the observIQ Universal Agent source you would see an error similar to this in the explore section.

When manually reviewing the logs you will see this log entry which matches to the example from the image above:

{"level":"warn","ts":"2021-01-27T20:05:54.946Z","msg":"no files match the configured include patterns","operator_id
":"$.0dd3e182-a883-4c52-8ec2-664760ec1697.nginx_access_reader","operator_type":"file_input","include":["/var/log/ng
inx1/access.log"]}

Errors

In the logs if you see an error. If the resolution isn't clear then reach out to support for further assistance. You can provide the specific error and include it in the help request. We may request the log files from the logs directory in the observIQ agnt to help troubleshoot further. You can reach us through the chat icon in the top right of the observIQ platform.

Missing Logs

If you don't see logs in observIQ Cloud after setting up an Agent and a Source, return to the Manage > Agents page. Verify the agent is visible and in a healthy status. Click the individual agent, and verify the expected Sourced is deployed to the agent.

If you continue to have issues, check the logagent.log and manager.log for errors or for more information. Always feel free to reach out to the observIQ team if an error is unclear or you need assistance.