Event Logs
The Event Logs feature allows you to access and review log information generated for your SLOs configured with the Direct connection method. By Checking the logs, you to discover potential issues with your SLOs or Data Sources, understand the problem, and verify if it's working correctly after applying a fix.
You can access Event Logs through the Data Source Details page.
Assumptionsβ
Nobl9 features support:
Nobl9 supports Event Logs for all data sources connected through the Direct method except Splunk Observability
Event Logs are not available for Replay and SLI Analyzer
Event Logs retention:
- Nobl9 stores Event Logs for ten days and automatically deletes any older Event Logs
Filtering and visibility of Event Logs:
Currently, Nobl9 displays only the error-level type of Event Logs:
Image 1: List of Event Logs in the UI You can view up to 10 000 Event Logs for a single data source, up to 50 Event Logs per page
User Experienceβ
Event Logs and RBACβ
The following RBAC rules apply to the Event Logs feature:
Only Organization Admins can activate or turn off Event Logs collection (through UI or
sloctl
)Organization Admins, Project Owners, and Project Editors can only view Event Logs
Activating Event Logs in the UIβ
Organization Admins can activate Event Logs collection. For this:
Go to Integrations > Sources.
Click the required Direct in the Data Source list to open its details.
Open LOGS. Click ACTIVATE LOGS:

Activating Event Logs via sloctlβ
Directs supporting log collection accept the logCollectionEnabled
field (boolean) in their YAML definition.
- Activate Logs
- Turn off Logs
Hereβs a YAML sample to activate logs collection for Amazon Cloudwatch:
- apiVersion: n9/v1alpha
kind: Direct
metadata:
displayName: cloudwatch-direct
name: cloudwatch-direct
project: default
spec:
cloudWatch:
accessKeyID: '[hidden]'
secretAccessKey: '[hidden]'
historicalDataRetrieval:
defaultDuration:
unit: Day
value: 0
maxDuration:
unit: Day
value: 0
logCollectionEnabled: true
queryDelay:
unit: Minute
value: 1
releaseChannel: beta
sourceOf:
- Metrics
status:
directType: CloudWatch
Hereβs a YAML sample to turn off logs collection for Amazon Cloudwatch:
- apiVersion: n9/v1alpha
kind: Direct
metadata:
displayName: cloudwatch-direct
name: cloudwatch-direct
project: default
spec:
cloudWatch:
accessKeyID: '[hidden]'
secretAccessKey: '[hidden]'
historicalDataRetrieval:
defaultDuration:
unit: Day
value: 0
maxDuration:
unit: Day
value: 0
logCollectionEnabled: false
queryDelay:
unit: Minute
value: 1
releaseChannel: beta
sourceOf:
- Metrics
status:
directType: CloudWatch
Reviewing Event Logsβ
You can filter the logs for a given data source by a single SLO and search for a text string from the log content:

Filtering is available for Organization Admins, Project Owners and Project Editors.
Turning off Event Logsβ
Organization Admins can turn off Event Logs collection. For this:
Go to Integrations > Sources.
Click the required Direct in the Data Source list to open its details.
Open LOGS. Click Turn off logs:

In some cases, Nobl9 may automatically disable Event Logs. Should this happen, reach out to Nobl9 Support for more details on these issues.