Manage Source-Entity Association
When you use Management Agents to continuously collect logs, you must configure a source-entity association to enable a source for specific entities to collect the log data.
Configure New Source-Entity Association
Configure new source-entity associations to enable continuous log collection after installing the Management Agent. To configure entity associations on a large scale, you can use the source-entity association APIs.
Collection instructions will be sent down to the agent that is monitoring this entity as defined earlier and the log collection will start. Go to Agent Collection Warnings section to view the warnings for log collection. Note that the list of warnings correspond to all the association entities for this source.
If you have any issues with the management agent collecting logs, ensure that the log files that are monitored are readable to the mgmt_agent user that the Management Agent runs as. Wait for a few minutes to view the logs in the Log Explorer. When collecting logs from the OS files, the older log files are collected first. Therefore, you may see older logs loaded before the newer logs. After the agent has collected the historic logs, you will start seeing only newer logs being collected.
Enable Auto-Association for a Source
To enable log collection from all the entities of the entity types specified in the source definition, enable auto-association.
Using the following steps to auto-associate the source, you can enable log collection from all the eligible and currently unassociated entities and all the future eligible entities that get created:
-
Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.
-
The administration resources are listed in the left hand navigation pane under Resources. Click Sources.
The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.
-
Click the source name for which you want to enable the auto-association. The source details page opens.
-
Under Source Information, click Enable next to Auto Association.
The Enable Auto Association dialog box opens.
-
Select the compartment that contains the log group in which the log data should be located after it is collected from the entities and indexed.
-
Select the log group where the log data must be stored.
To create a new log group, select the compartment, and click Create Log Group. In the dialog box, enter the name and description. Click Create.
-
Click Enable.
After the auto-association is enabled, at a later point, when any new entities of the entity types specified in the source definition are discovered by Oracle Logging Analytics, then they are auto-associated with the source.
Stop Log Collection from an Entity
When a source and an entity get associated, then the log collection is enabled from that entity. The details of log indexing and pre-processing are specified in the source definition. When the log collection from that entity must be stopped, then dissociate the entity from the source.
-
Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.
-
The administration resources are listed in the left hand navigation pane under Resources. Click Sources.
The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.
-
Click the source name. The source details page opens. The Associated Entities section displays the list of entities that are associated with this source, and from where the logs are currently collected.
-
Select the entity from which you want to stop collecting logs. Click Remove entities.
To stop the log collection for this source, use the multi-select feature to select all the entities.
Alternatively, if you have enabled auto-association for the source, and want to stop collection for all the associated entities, then you can disable the auto-association and remove the existing entity associations. See Disable Auto-Association for a Source.
The association with the selected entity is now removed, the log collection is stopped from it, and the entity is now moved to the Unassociated Entities section.
Disable Auto-Association for a Source
By enabling auto-association, you have automatically associated all the eligible entities of the entity types specified in the source definition, with the source. To disable the auto-association and to be selective with the source-entity association, follow these steps:
-
Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.
-
The administration resources are listed in the left hand navigation pane under Resources. Click Sources.
The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.
-
Click the source name for which you want to disable the auto-association. The source details page opens.
-
Under Source Information, click Disable next to Auto Association.
The Disable Auto Association dialog box opens.
-
Click Disable to auto-association feature for the source. With this, any new eligible entities will not be automatically associated with the source. However, the log collection will continue for the entities that were previously associated through the auto-association feature.
Optionally, you can stop the log collection from all the previously associated entities by removing their association with the source. For that, enable the check box Remove all existing entity association in the Disable Auto Association dialog box before confirming.