How to collect logs from HLA data input?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-23-2024 02:12 AM
Hi all,
I want to collect rsyslogs from my linux servers by HLA.
I made "Data Input", "Data Input Mapping" and "Data input Preprocessor"
Also check test result from Raw Input Samples.
I thought I could check logs in logviewer if I did this step.
Is there anything I should do?
I followed
Configure advanced settings for Rsyslog, Splunk, or TCP data inputs (servicenow.com)
Log data auto-mapping and mapping (servicenow.com)
Edit raw log data before processing (servicenow.com)
Thanks.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-06-2024 11:08 AM
Hi Hank.
You followed the correct documentation guides so I'd like to back up and make sure you have the correct prerequisites that make those successful.
Steps to success
- MID Server requirements - Follow this guide to make sure that your MID server is properly sized and dedicated to HLA log inputs for your environment/instance. This will be an important part of successful flow.
- Check if data is coming into the MID server - Do you see data coming into the MID Server pre-processor? If not there is an issue with data capture.
- Check if data is coming into the instance - Do you see samples coming into the Data Input mapping? If not there is an issue with data capture.
- Check if data is in the Log Viewer - Do you see data shown in the Log Viewer? This is the final step of assurance that data is being processed and arriving successfully into the system. If not there is an issue with data capture.
For all things MID server related check this collection of documentationMID Servers and specifically Troubleshooting MID Servers
If steps 2-4 have any issues reference Identify and Resolve Log Stream Issues for clues on roles and other items specifically to HLA.
By reassuring the data ingest flow then it is the art form of defining the Data Inputs and affirming Source Types to get you on a successful path with HLA.
Please reply if you have further questions or need additional assistance from our team. We are willing to help you be successful in getting things working smoothly.
Cheers!
Doug