Manage Source-Entity Association

When you use Management Agents to continuously collect logs, you must configure a source-entity association to enable a source for specific entities to collect the log data.

Configure New Source-Entity Association

Configure new source-entity associations to enable continuous log collection after installing the Management Agent. To configure entity associations on a large scale, you can use the source-entity association APIs.

For more details about the source-entity association APIs, see Logging Analytics API.
  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

    The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

    The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.

  2. Click the source name for which you want to create the source-entity association. The source details page opens. Locate the Resources section on the left side of the page.

    Select the compartment on the left of the Source detail page. This will limit the entities visible to you based on the compartment you selected.

  3. Click Unassociated Entities to view the entities that are eligible for association with this source. The entities listed are those which of the entity-type specified in the source definition and are available in the selected compartment.

    The entities which are not eligible for association with this source are listed in the Ineligible Entities section. Typically, the reasons for ineligibility are the absence of Management Agent on the host, it not being ready for log collection, agent validation pending, or agent policy issues. After the Management Agent is installed successfully on the entity host and the entity is configured to use the Management Agent, the entity disappears from the Ineligible Entities list and appears in the Unassociated Entities list.

  4. Select one or more unassociated entities to associate with this source and click Add Association.

    The Add Association dialog box opens.

  5. Select the compartment that contains the log group in which the log data should be located after it is collected and indexed.
  6. Select the log group that you created earlier during the setup.

    To create a new log group, select the compartment, and click Create Log Group. In the dialog box, enter the name and description. Click Create.

  7. Click Submit.

    The selected entity is now moved to the Associated Entities section where the status of the association is displayed. If the source-entity association task failed, then click Retry Association.

Collection instructions will be sent down to the agent that is monitoring this entity as defined earlier and the log collection will start. Go to Agent Collection Warnings section to view the warnings for log collection. Note that the list of warnings correspond to all the association entities for this source.

If you have any issues with the management agent collecting logs, ensure that the log files that are monitored are readable to the mgmt_agent user that the Management Agent runs as. Wait for a few minutes to view the logs in the Log Explorer. When collecting logs from the OS files, the older log files are collected first. Therefore, you may see older logs loaded before the newer logs. After the agent has collected the historic logs, you will start seeing only newer logs being collected.

Enable Auto-Association for a Source

To enable log collection from all the entities of the entity types specified in the source definition, enable auto-association.

Using the following steps to auto-associate the source, you can enable log collection from all the eligible and currently unassociated entities and all the future eligible entities that get created:

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

  2. The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

    The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.

  3. Click the source name for which you want to enable the auto-association. The source details page opens.

  4. Under Source Information, click Enable next to Auto Association.

    The Enable Auto Association dialog box opens.

  5. Select the compartment that contains the log group in which the log data should be located after it is collected from the entities and indexed.

  6. Select the log group where the log data must be stored.

    To create a new log group, select the compartment, and click Create Log Group. In the dialog box, enter the name and description. Click Create.

  7. Click Enable.

Note

After the auto-association is enabled, at a later point, when any new entities of the entity types specified in the source definition are discovered by Oracle Cloud Logging Analytics, then they are auto-associated with the source.

Stop Log Collection from an Entity

When a source and an entity get associated, then the log collection is enabled from that entity. The details of log indexing and pre-processing are specified in the source definition. When the log collection from that entity must be stopped, then dissociate the entity from the source.

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

  2. The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

    The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.

  3. Click the source name. The source details page opens. The Associated Entities section displays the list of entities that are associated with this source, and from where the logs are currently collected.

  4. Select the entity from which you want to stop collecting logs. Click Remove entities.

    To stop the log collection for this source, use the multi-select feature to select all the entities.

    Alternatively, if you have enabled auto-association for the source, and want to stop collection for all the associated entities, then you can disable the auto-association and remove the existing entity associations. See Disable Auto-Association for a Source.

The association with the selected entity is now removed, the log collection is stopped from it, and the entity is now moved to the Unassociated Entities section.

Disable Auto-Association for a Source

By enabling auto-association, you have automatically associated all the eligible entities of the entity types specified in the source definition, with the source. To disable the auto-association and to be selective with the source-entity association, follow these steps:

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

  2. The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

    The sources listing page will show all Oracle-defined and custom defined sources. You can search and identify one that you want to use.

  3. Click the source name for which you want to disable the auto-association. The source details page opens.

  4. Under Source Information, click Disable next to Auto Association.

    The Disable Auto Association dialog box opens.

  5. Click Disable to auto-association feature for the source. With this, any new eligible entities will not be automatically associated with the source. However, the log collection will continue for the entities that were previously associated through the auto-association feature.

    Optionally, you can stop the log collection from all the previously associated entities by removing their association with the source. For that, enable the check box Remove all existing entity association in the Disable Auto Association dialog box before confirming.