Log Collection

Overview

nxtLog collects logs from all registered nodes via file-based collection and syslog forwarding. Centralized log data flows into the log index for full-text search and alert-based detection. This page covers configuring log sources and troubleshooting ingestion issues.

Administrator Access Required — This operation requires the admin role. Contact your NxtSight administrator if you do not have sufficient permissions.

Prerequisites

Administrator credentials with the admin role
nxtLog agents deployed on target nodes (see Agent Configuration)

Configuring Log Sources

Dashboard
Configuration File

View configured log sources

Navigate to Monitor Center > Logging (Log Sources, admin view). Each log source defines a file path pattern, the node scope it applies to, and the expected format.

Add a log source

Click Add Log Source and provide:

Field	Description
Path Pattern	Glob pattern for the log file (e.g., `/var/log/nova/*.log`)
Node Selector	Applies this source to nodes matching the label (e.g., `role=compute`)
Format	`json`, `plain`, or `multiline` (for stack traces)
Service Label	Tag applied to all ingested events for filtering

Verify ingestion

After saving, navigate to Monitor Center > Logging (admin view) and filter by the new service label. Entries should appear within the configured scrape interval.

Log events appear in Log Explorer with correct service label and timestamp.

Log sources can also be defined in /etc/nxtradar/log-sources.yaml on the managed node:

/etc/nxtradar/log-sources.yaml

sources:
  - path: /var/log/nova/*.log
    format: plain
    labels:
      service: nova
      role: compute

  - path: /var/log/cinder/*.log
    format: plain
    labels:
      service: cinder

  - path: /var/log/docker/containers/**/*.log
    format: json
    labels:
      service: docker

  - path: /var/log/syslog
    format: plain
    labels:
      service: syslog

Reload the agent after updating the configuration:

Reload agent configuration

systemctl reload nxtradar-agent

Syslog Forwarding

Services that write to syslog rather than log files can forward directly to nxtLog’s syslog receiver.

Configure rsyslog forwarding

Add a forwarding rule to /etc/rsyslog.d/99-nxtradar.conf on the source node:

/etc/rsyslog.d/99-nxtradar.conf

# Forward all facility/severity combinations to nxtLog via TCP
*.* @@nxtradar.NxtSight.internal:5140

Use TCP forwarding (@@) for reliable delivery. UDP forwarding (@) may drop messages under high log volume and is not recommended for production.

Reload rsyslog

systemctl reload rsyslog

Verify ingestion

Navigate to Monitor Center > Logging (admin view) and filter by service:syslog and the source hostname. Entries should appear within 60 seconds.

Syslog events appear in Log Explorer with correct host and timestamp.

Log Format Parsers

Configure parsers for structured log formats to enable field-level filtering in Log Analytics:

Format	Configuration	Notes
`json`	Automatic	Fields extracted automatically from JSON keys
`plain`	Default	Full-text search only; no structured field extraction
`multiline`	Requires pattern	Stack traces and multi-line entries joined before indexing

For multiline logs (Java stack traces, Python tracebacks):

Multiline log source configuration

sources:
  - path: /var/log/app/*.log
    format: multiline
    multiline:
      start_pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}"
      negate: false
      match: after
    labels:
      service: app-service

Next Steps

Agent Configuration

Deploy agents that run the log collection defined here

Retention Policies

Configure how long collected log data is retained

Log Analytics (User Guide)

How tenants query and create alerts from the logs you’ve configured

Troubleshooting

Diagnose log ingestion backlogs and missing log data

Core Services

Other Services

Log Collection

Overview

Configuring Log Sources

View configured log sources

Add a log source

Verify ingestion

Syslog Forwarding

Configure rsyslog forwarding

Reload rsyslog

Verify ingestion

Log Format Parsers

Next Steps

Agent Configuration

Retention Policies

Log Analytics (User Guide)

Troubleshooting

​Overview

​Configuring Log Sources

View configured log sources

Add a log source

Verify ingestion

​Syslog Forwarding

Configure rsyslog forwarding

Reload rsyslog

Verify ingestion

​Log Format Parsers

​Next Steps

Agent Configuration

Retention Policies

Log Analytics (User Guide)

Troubleshooting

Overview

Configuring Log Sources

Syslog Forwarding

Log Format Parsers

Next Steps