IBM Cloud Docs
Logging agent

Logging agent

The logging agent collects and forwards logs to your IBM Log Analysis instance. After you provision an IBM® Log Analysis instance, you must configure a logging agent for each log source that you want to monitor.

As of 28 March 2024 the IBM Log Analysis and IBM Cloud Activity Tracker services are deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs, which replaces these two services, prior to 30 March 2025. IBM Cloud Logs will become generally available during the summer of 2024 in Frankfurt and Madrid with day-one support for EU-managed controls. The service will continue its worldwide multizone region (MZR) roll-out through 3Q2024. For information about IBM Cloud Logs, see the IBM Cloud Logs documentation.

You can configure a logging agent to connect to an IBM Log Analysis instance through the public network or through the private network. By default, the agent connects through the public network. To connect to IBM Cloud® services over a private network, you must have access to the classic infrastructure and enable virtual routing and forwarding (VRF) and connectivity to service endpoints for your account.

The logging agent authenticates by using the logging ingestion key and opens a secure web socket to the IBM Log Analysis ingestion servers.

By default, the logging agent monitors all files with extension .log, and extensionless files under /var/log/. The logging agent for Kubernetes automatically collects STDOUT and STDERR logs.

The logging agent tails for new log data, and looks for new files that are added to the logging directories that the agent monitors.

To configure a logging agent you will need to:

  1. Understand your storage requirements.

  2. Install the appropriate agent for your environment: Kubernetes or Linux.

  3. Configure your agent.