What Do I Do If I Could Not Query New Logs on LTS?

Background

New logs cannot be queried on the LTS console.

Impact on the System

Users cannot query service logs.

Possible Causes

1. ICAgent Collection is disabled on the LTS console.
2. ICAgent fails to report logs to LTS.
3. The collection configuration set on the LTS console is incorrectly delivered to ICAgent.

Fault Locating

Perform the following steps:

1. Check whether ICAgent collection is enabled.
   1. Log in to the management console and choose Management & Deployment > Log Tank Service.
   2. Choose Configuration Center.
   3. Click the ICAgent Collection tab and check whether ICAgent collection is enabled. If not, enable it.

2. Check the ICAgent collection configuration delivered last time.
   1. Log in to the ECS where ICAgent is installed.
   2. Run the cd /var/ICAgent command to go to the ICAgent log directory.
   3. Run the following command to view the log collection configuration.

      zgrep switchList *.zip //Query the compressed package of transferred logs.
      cat oss.icAgent.trace | grep switchList //Query the current log file.

      

      Search for the latest log time configuration from the filtering result and check whether the value of switch.log is true (indicating that ICAgent collection is enabled).

3. Check whether the value of switch.log in the ICAgent collection file is true (indicating that ICAgent collection is enabled).
   1. Log in to the ECS where ICAgent is installed.
   2. Query the ICAgent collection file.

      cat /var/share/oss/manager/ICProbeAgent/internal/TRACE_CONFIG/swithes_context.json

      

      The value of switch.log in the ICAgent collection file is true.

4. Check whether logs fail to be sent.
   1. Log in to the ECS where ICAgent is installed.
   2. Run the cd /var/ICAgent command to go to the ICAgent log directory.
   3. Query the log that failed to be sent.

      cat oss.icAgent.trace | grep httpsend | grep 'dataType:TRACE' | grep failed
      zgrep 'dataType:TRACE' *.zip | grep httpsend | grep failed

      

      If failed is displayed, contact LTS technical support.

5. Check whether the collection configuration set on the LTS console has been delivered to ICAgent.
   1. Log in to the ECS where ICAgent is installed.
   2. Run the cd /var/ICAgent command to go to the ICAgent log directory.
   3. Filter log files to query the log collection configuration set on the LTS console.

      cat oss.icAgent.trace | grep 'als event' | grep -v grep | tail -n 1

      

      (The preceding figure is for reference only.) If the log group, log stream, and collection path you set appear in the filtering result, the log collection configuration has been delivered to ICAgent.

   4. If the log file cannot be found, query the compressed log package.

      zgrep 'als event' *.zip | grep -v grep | tail -n 1

      

      If the log group, log stream, and collection path you set appear in the compressed log package, the log collection configuration has been delivered to ICAgent.

   5. Log in to the LTS console and choose Log Ingestion in the navigation pane. Check the log collection configurations on the log ingestion setting page.