Skip to content

Troubleshooting Log Sources

In this section, we will cover common issues related to log sources and how to troubleshoot them effectively.

Log Source is not visible in Events

If no events from a log source are visible in Discover in Events datasource, it is possible that the events are not parsed correctly and are sent to Others event lane.

Navigate to Others data source in Discover and check values of lmio.source field to find whether the log source is visible there. If it is, check the error.message field to find the reason why the events are not parsed correctly.

Log Source is not visible in both Events and Others

If the log source is not visible in both Events and Others data sources, it is possible that the log source is not connected to LogMan.io Collector or there are issues with the Collector.

Navigate to the Activity data source in Discover and check whether the log source is visible there.

If the log source is NOT visible in Activity:

One of the following issues may be the cause:

  • No connection: The log source is not connected to the Collector. Verify that the log source is properly configured to send logs to the Collector and that the Collector is running.
  • Connection issues: The log source is attempting to connect to the Collector, but the connection is failing. Check the network connectivity between the log source and the Collector, and verify that no firewall rules are blocking the connection. Use tools like netcat for network diagnostics.
  • Collector issues: The log source is connected, but the Collector itself has problems. Check the Collector logs for errors or warnings related to log collection.

If the log source IS visible in Activity but Events and Others are empty:

This indicates that logs are being collected but there are issues with log processing. Check the following:

  • Processing delays: The logs are collected and sent to Archive, but processing is delayed. Navigate to system tenant > Tools >> Grafana and open Dashboards >> Kafka Lag Overview to check for processing lag. If there is lag in LMIO Parsec or LMIO Depositor, the logs may be awaiting processing.
  • Verify that LMIO Parsec and LMIO Depositor are running.
  • Check their logs for errors or warnings related to log processing. Open Maintenance >> Services to find the corresponding microservice and view its logs.