---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create an ACC log policy

# Create an Agent Client Collector log policy {#ariaid-title1}

* Release version: Yokohama
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Create an ACC log policy when no default policy exists for the CI you want Agent Client Collector to monitor.

## Before you begin

* The Agent Client Collector Log Analytics (ACC-L) application, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home), must be installed. For more information, see [Agent Client Collector Installation](https://www.servicenow.com/docs/012KhsJorq5d~zoirdDc0w "You can install the Agent Client Collector on any supported host machine. The Agent Client Collector connects to a MID Server using the HTTP/S protocol, and the connection remains active after being established. One MID Server may handle several agents simultaneously, while a single agent works with one MID Server at a time and switches to a different MID Server when necessary to provide failover protection.").
* The Agent Client Collector comes with the default servicenow user. Ensure that this user has read access to enable Agent Client Collector to view all the configured log paths. For example, the Agent Client Collector servicenow user that comes installed with the base system does not have permissions to view the paths to /var/log/ in Linux and C:\\Windows\\System32 in Windows. For information about configuring permissions for the servicenow user, see the [ACC-L Permission Denied issues
  \[KB1117271\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1117271) article in the Now Support Knowledge Base.
{#hla-acc-log-policies__ul_uyg_vx2_vsb}

Role required: agent_client_collector_admin

## Procedure

1. Navigate to AllACC Log AnalyticsACC Log Policies.  
   The Policies page displays all Log Analytics policies. For a list of the policies that come with the base system, see [Agent Client Collector Log Analytics default policies and checks](https://www.servicenow.com/docs/vergaZvo7jfuCh2IxjvXeg "Agent Client Collector Log Analytics provides various default policies and checks.").
2. Select New.  
   Note:  
   For general information about creating an ACC policy, see [Create an Agent Client Collector policy](https://www.servicenow.com/docs/0KxRUBj1j0vmDDgouYKZ0g "Policies consist of the CIs monitored by the Agent Client Collector and the checks that run on those CIs. When creating a policy, you configure a filter which determines the CIs on which the checks are to run. For example, a policy to run checks on all Apache web servers. You can create new policies or edit the default policies.").
3. On the form, fill in the fields.  
   {#hla-acc-log-policies__table_ewl_c4m_vsb__entry__2}

   | Field | Description |
   |-|-|
   | Name | A descriptive name for the policy. |
   | Description | Description of the policy. |
   | Publish status | Hard-coded as Draft, which means that the policy has not yet been published. You cannot edit this field. |
   | Hierarchy | Hard-coded as None. When a child policy is added to the policy, the value changes to Parent. Child policies have a value of Child. |
   [Table 1. Policy Definition Form]

   {#hla-acc-log-policies__table_ewl_c4m_vsb}
4. On the Checks tab, associate the log policy with the relevant log shipper check.  
   * For Linux and Windows, except for Windows event logs, select the log shipper check definition.
   * For Windows event logs only, select the log shipper for win events check definition.
   {#hla-acc-log-policies__ul_trn_pcq_lsb}
5. On the Monitored CIs tab, specify the CIs to which the policy applies.
   1. Choose the CI type to be monitored.  
      * Monitored CI type by filter: Select the monitored CI type. You can narrow down the CIs that will be monitored by using filter conditions.
      * Monitored CI type by script: Specify the monitored CIs by using a script.
      * Monitored CI type by CMDB Group: Specify the monitored CIs by using CMDB group queries.

      {#hla-acc-log-policies__ul_cw1_bnl_vsb}

      For more information about choosing monitored CI types, see [Create an Agent Client Collector policy](https://www.servicenow.com/docs/0KxRUBj1j0vmDDgouYKZ0g "Policies consist of the CIs monitored by the Agent Client Collector and the checks that run on those CIs. When creating a policy, you configure a filter which determines the CIs on which the checks are to run. For example, a policy to run checks on all Apache web servers. You can create new policies or edit the default policies.").
   2. **Optional:** Monitor only CIs that are associated with an Application Service by selecting Filter Monitored CIs by Application Service.  
      You can specify the Application Services to be monitored by using filter conditions. Agent Client Collector will only retrieve the logs of CIs that are associated with these Application Services.
   {#hla-acc-log-policies__substeps_gz4_mps_4sb}
6. Save the log policy.  
   In the Check instances related list, a check instance record is created.
7. Open the relevant check instance record and then select Edit in Sandbox.
8. Select the Log path configurations related list.
9. Add a log path for the check instance.  
   Note:  
   A check must have at least one log path configured for it to enable streaming logs. For more information about checks, see [Checks and policies](https://www.servicenow.com/docs/ft6B1g3pkBxbL537XUnCNg "A check is a combination of a command and its configuration. The check is executed on the Agent Client Collector's devices to gather data from those devices.").
   1. Select New.
   2. On the form, fill in the fields.  
      {#hla-acc-log-policies__table_ejm_p55_rqb__entry__2}

      | Field | Description |
      |-|-|
      | Path | The full path from where the logs are streamed. You can use a wildcard. This field is required. |
      | Component | The device type or stack layer that provides a context for the logs, used for anomaly detection and correlation. For example: Tomcat. |
      | Source Type | Defines how Health Log Analytics handles a specific log type and parses the log data. For example: Tomcat Catalina. |
      [Table 2. Configuration form]

      {#hla-acc-log-policies__table_ejm_p55_rqb}
   3. **Optional:** For shipping multiline logs using Filebeat, configure the following properties.  
      These parameters control how Agent Client Collector
      Log Analytics (ACC-L) handles messages that span multiple lines of text.

      For more information, see [Manage multiline messages](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) in the Elastic documentation.
      {#hla-acc-log-policies__table_i3n_1v5_rqb__entry__2}

      | Field | Description |
      |-|-|
      | multiline.pattern (regex) | The regular expression to match. Note: You must define this property before you can configure the multiline.match and multiline.negate properties. |
      | multiline.match | How ACC-L combines matching lines into a single log line. The available options are None, Before, and After. Default is None. |
      | multiline.negate | Option for determining whether the pattern identified in the log lines is negated. The available options are None, True, and False. Default is None. |
      [ ]

      {#hla-acc-log-policies__table_i3n_1v5_rqb}
   4. **Optional:** Define the following properties that control the Filebeat YML configuration.  
      {#hla-acc-log-policies__table_o1d_stm_h5b__entry__2}

      | Field | Description |
      |-|-|
      | Fields | Field that enables you to include and exclude information in the output. For example, you can add a field for filtering the log data. Add more Field rows by selecting the plus icon next to the Value field: ![Plus icon.](). Remove a Field row by selecting the minus icon: ![Minus icon.](). For more information, see the Log input [Fields](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-fields) description in the Elastic documentation. |
      | Configuration Options | Field that enables you to add configuration options to the log lines. For example, you can add the encoding to use. Note: Define only configuration options that are supported by Filebeat. For more information, see the Log input [Configuration options](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-options) description in the Elastic documentation. |
      [ ]

      {#hla-acc-log-policies__table_o1d_stm_h5b}
   5. Select OK.  
      The log path is created.
   {#hla-acc-log-policies__substeps_cr1_gs5_rqb}
10. Select Return to Policy.
11. On the policy form, select Publish.  
    The policy's Publish status changes to Published.
12. **Optional:** Activate the policy by selecting Activate.
{#hla-acc-log-policies__steps_ivb_yhs_tqb}

## What to do next

[Verify that the data input is streaming data](https://www.servicenow.com/docs/oOfiw4LViA_6PhNwfUsPKQ "Make sure that your ACC data inputs are streaming data properly by identifying and resolving log streaming issues.").

*[\>]: and then