Event logs
Event logs allow access and review log information generated for your SLOs, SLOs with Replay, and SLI Analyzer.
Event logs are supported for all data sources except for Splunk Observability, provided that:
- You add your required data source using the direct connection method
- For SLI Analyzer and Replay: along with the direct connection, you select the Beta channel to add your data source
To use event logs, activate them for the required data source in the UI or using sloctl.
Event logs appear under the data source details page. Logs are recorded for every failed data retrieval attempt for SLOs based on this data source and failed SLI analyses for this data source.
- Currently, it records error-level logs only
- Nobl9 stores event logs for 10 days. Older logs are automatically deleted
- You can view up to 10 000 event logs per a data source and up to 50 event logs per page
Event logs and RBACβ
The following RBAC rules apply to the event logs feature:
- Organization Admins can activate, turn off, view, and filter event logs
- Project Owners and Project Editors can view and filter event logs
Activating and turning off event logs in the UIβ
Organization Admins can activate and turn off the event logs collection.
To activate event logs:
-
Go to Integrations > Sources.
-
Click the required direct in the data source list to open its details.
-
Open LOGS. Click ACTIVATE LOGS:
To turn off event logs:
-
Go to Integrations > Sources.
-
Click the required direct in the data source list to open its details.
-
Open LOGS. Click Turn off logs:
In some cases, Nobl9 can automatically turn off event logs. Should this happen, contact Nobl9 support for assistance.
Activating and turning off event logs using sloctlβ
Directs with the log collection support accept the logCollectionEnabled
field (boolean) in their YAML definition.
- Activate logs
- Turn off logs
Hereβs a YAML sample to activate the log collection for Amazon Cloudwatch:
- apiVersion: n9/v1alpha
kind: Direct
metadata:
displayName: cloudwatch-direct
name: cloudwatch-direct
project: default
spec:
cloudWatch:
accessKeyID: '[hidden]'
secretAccessKey: '[hidden]'
historicalDataRetrieval:
defaultDuration:
unit: Day
value: 0
maxDuration:
unit: Day
value: 0
logCollectionEnabled: true
queryDelay:
unit: Minute
value: 1
releaseChannel: beta
sourceOf:
- Metrics
status:
directType: CloudWatch
Hereβs a YAML sample to turn off the log collection for Amazon Cloudwatch:
- apiVersion: n9/v1alpha
kind: Direct
metadata:
displayName: cloudwatch-direct
name: cloudwatch-direct
project: default
spec:
cloudWatch:
accessKeyID: '[hidden]'
secretAccessKey: '[hidden]'
historicalDataRetrieval:
defaultDuration:
unit: Day
value: 0
maxDuration:
unit: Day
value: 0
logCollectionEnabled: false
queryDelay:
unit: Minute
value: 1
releaseChannel: beta
sourceOf:
- Metrics
status:
directType: CloudWatch
Viewing event logsβ
On your data source details page, go to the LOGS tab. Here you find this data source's logs recorded for every failed data retrieval attempt in the following cases:
- SLOs based on this data source
Displays how many SLOs are affected under the # of Affected SLOs column - Failed SLI analyses for this data source
Since SLI Analyzer doesn't involve SLOs, its error logs show0
under the # of Affected SLOs column
Organization Admins, Project Owners and Project Editors can filter the logs for a given data source by a single SLO and search for a text string from the log content: