Skip to main content

Event logs

Reading time: 0 minute(s) (0 words)

Event logs allow access and review log information generated for your SLOs, SLOs with Replay, and SLI Analyzer.

Prerequisites

Event logs are supported for all data sources except for Splunk Observability, provided that:

  • You add your required data source using the direct connection method
  • For SLI Analyzer and Replay: along with the direct connection, you select the Beta channel to add your data source

To use event logs, activate them for the required data source in the UI or using sloctl.

Event logs appear under the data source details page. Logs are recorded for every failed data retrieval attempt for SLOs based on this data source and failed SLI analyses for this data source.

  • Currently, it records error-level logs only
  • Nobl9 stores event logs for 10 days. Older logs are automatically deleted
  • You can view up to 10 000 event logs per a data source and up to 50 event logs per page

Event logs and RBAC​

The following RBAC rules apply to the event logs feature:

Activating and turning off event logs in the UI​

Organization Admins can activate and turn off the event logs collection.

To activate event logs:

  1. Go to Integrations > Sources.

  2. Click the required direct in the data source list to open its details.

  3. Open LOGS. Click ACTIVATE LOGS:

Activate event logs
Image 1: Activating event logs in the UI

To turn off event logs:

  1. Go to Integrations > Sources.

  2. Click the required direct in the data source list to open its details.

  3. Open LOGS. Click Turn off logs:

Turn off event logs
Image 2: Turning off event logs in the UI
info

In some cases, Nobl9 can automatically turn off event logs. Should this happen, contact Nobl9 support for assistance.

Activating and turning off event logs using sloctl​

Directs with the log collection support accept the logCollectionEnabled field (boolean) in their YAML definition.

Here’s a YAML sample to activate the log collection for Amazon Cloudwatch:

- apiVersion: n9/v1alpha
  kind: Direct
  metadata:
    displayName: cloudwatch-direct
    name: cloudwatch-direct
    project: default
  spec:
    cloudWatch:
      accessKeyID: '[hidden]'
      secretAccessKey: '[hidden]'
    historicalDataRetrieval:
      defaultDuration:
        unit: Day
        value: 0
      maxDuration:
        unit: Day
        value: 0
    logCollectionEnabled: true
    queryDelay:
      unit: Minute
      value: 1
    releaseChannel: beta
    sourceOf:
    - Metrics
  status:
    directType: CloudWatch

Viewing event logs​

On your data source details page, go to the LOGS tab. Here you find this data source's logs recorded for every failed data retrieval attempt in the following cases:

  • SLOs based on this data source
    Displays how many SLOs are affected under the # of Affected SLOs column
  • Failed SLI analyses for this data source
    Since SLI Analyzer doesn't involve SLOs, its error logs show 0 under the # of Affected SLOs column
Accessing event logs
Image 3: Event logs recorded

Organization Admins, Project Owners and Project Editors can filter the logs for a given data source by a single SLO and search for a text string from the log content:

Filter event logs
Image 4: Filtering event logs in the UI
Last updated on
On this page