Collection Agent log file
Overview Copied
The Collection Agent uses a separate log file from the Netprobe. The log settings for Collection Agent use Logback and are stored in logback.xml.
The logback has the following limitations by default:
- Each log file is limited to 100MB.
- Logs are retained for 30 days.
- The total log storage will not exceed 10GB.
- Logs will rollover daily.
You can use the following configuration:
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${COLLECTION_AGENT_DIR:-.}/collection-agent.log</file>
<append>true</append>
<immediateFlush>true</immediateFlush>
<rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
<fileNamePattern>${COLLECTION_AGENT_DIR:-.}/collection-agent-%d{yyyy-MM-dd}.%i.log</fileNamePattern>
<maxFileSize>100MB</maxFileSize>
<maxHistory>30</maxHistory>
<totalSizeCap>10GB</totalSizeCap>
</rollingPolicy>
For more information on the other available options for modifying the logger settings, see Logback.
By default, the Collection Agent log file is stored in the collection-agent.log of the working directory. If you are running a managed Collection Agent and you configured the Log directory parameter in GSE, then the collection-agent.log will be in that specified location.
Enable log masking Copied
You can enable log masking in Collection Agent by configuring Logback to use the Geneos log masking layout and a rules file.
The following example shows a Logback configured with log masking:
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${COLLECTION_AGENT_DIR:-.}/collection-agent.log</file>
<append>true</append>
<immediateFlush>true</immediateFlush>
<rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
<fileNamePattern>${COLLECTION_AGENT_DIR:-.}/collection-agent-%d{yyyy-MM-dd}.%i.log</fileNamePattern>
<maxFileSize>100MB</maxFileSize>
<maxHistory>30</maxHistory>
<totalSizeCap>10GB</totalSizeCap>
</rollingPolicy>
<encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
<layout class="com.itrsgroup.platform.util.logging.logback.LogMaskingPatternLayout">
<pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger - %msg%n</pattern>
<rulesFile>${COLLECTION_AGENT_DIR:-.}/log-masking-rules.yaml</rulesFile>
</layout>
</encoder>
</appender>
The rulesFile element specifies the path to the log masking rules file. This configuration is specific to Logback-based components such as Collection Agent.
Example log-masking-rules.yaml:
- name: FQDN_example_com_or_con
regex: '(?i)\b(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+example\.(?:com|con)(?!\.[A-Za-z0-9-])\b'
replacement: '[redacted-host]'
For more information, see Log masking.