Datadog Tutorials: Log Collection & configuration using Datadog Agent

How to enable Log collection in Datadog?

To enable log collection with an Agent running on your host, change logs_enabled: false to logs_enabled: true in the Agent’s main configuration file (datadog.yaml).

Custom Log Collection in Datadog

Datadog Agent v6 can collect logs and forward them to Datadog from files, the network (TCP or UDP), journald, and Windows channels:

1. Create a new <CUSTOM_LOG_SOURCE>.d/ folder in the conf.d/ directory at the root of your Agent’s configuration directory.
2. Create a new conf.yaml file in this new folder.
3. Add a custom log collection configuration group with the parameters below.
4. Restart your Agent to take into account this new configuration.
5. Run the Agent’s status subcommand and look for <CUSTOM_LOG_SOURCE> under the Checks section.

Log Type in Datadog

Log Type: File

Log Type: TCP/UDP

Log Type: journald

Log Type: Windows Events

- Install the Datadog Agent

- Verify Datadog Agent Status and Look for "Logs Agent" which is not running.
$ sudo datadog-agent status

- Enable log collection
To enable log collection with the Agent, edit the datadog.yaml configuration file located at /etc/datadog-agent/datadog.yaml and set logs_enabled:true

- Monitor a custom file

$ sudo mkdir /etc/datadog-agent/conf.d/custom_log_collection.d/
$ sudo vi /etc/datadog-agent/conf.d/custom_log_collection.d/conf.yaml
logs:
    - type: file
      path: /var/log/syslog
      source: syslog
      service: syslog
$ sudo service datadog-agent restart

-  Validation. Verify 
$ sudo datadog-agent status
Datadog Agent Status and Look for "Logs Agent" which is running.
$ chmod -R 755 /var/log/
$ datadog-agent status

• Author
• Recent Posts

Follow me

Rajesh Kumar

Mentor for DevOps - DevSecOps - SRE - Cloud - Container & Micorservices at Software AG

Join my following certification courses...
- DevOps Certified Professionals (DCP)
- Site Reliability Engineering Certified Professionals (SRECP)
- Master in DevOps Engineering (MDE)
- DevSecOps Certified Professionals (DSOCP)
URL - https://www.devopsschool.com/certification/

My Linkedin - https://www.linkedin.com/in/rajeshkumarin

Follow me

Latest posts by Rajesh Kumar (see all)

• Installing Jupyter: Get up and running on your computer - November 2, 2024
• An Introduction of SymOps by SymOps.com - October 30, 2024
• Introduction to System Operations (SymOps) - October 30, 2024