Agent storage requirements

If the agent is unable to send logs to the IBM Log Analysis service, the logs are buffered. For example, buffered in local storage on the Kubernetes node. When the agent is able to send logs again, the buffered logs are sent. The most recent logs are sent first.

As of 28 March 2024 the IBM Log Analysis and IBM Cloud Activity Tracker services are deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs, which replaces these two services, prior to 30 March 2025. IBM Cloud Logs will become generally available during the summer of 2024 in Frankfurt and Madrid with day-one support for EU-managed controls. The service will continue its worldwide multizone region (MZR) roll-out through 3Q2024.

To avoid losing logs when logs are buffered, make sure you have enough local storage to buffer logs for the desired length of time. 24 hours is recommended for critical logs.

To determine how much local storage you might need, use the IBM Log Analysis dashboard to determine your usage or use the Usage API. To see your usage per day using the IBM Log Analysis dashboard, access your IBM Log Analysis instance and click Usage > Dashboard.

Local storage should be the amount of storage required for logging per day plus an additional 20% contingency.