Logs Issues

Pod or syslogs are not visible in the OpsRamp portal, even though the Kubernetes 2.0 agent pods are running.

Logs not Enabled
- During Kubernetes 2.0 integration, the logs option was not enabled.
- The manifest file may not have logs.enabled set to true.
Portal Setting not Enabled
- In the OpsRamp portal, Log Management must be enabled at the client level. If disabled, logs will not appear.
OpenTelemetry Pipeline not Running
- The Kubernetes 2.0 agent uses the OpenTelemetry pipeline to collect logs. If the pipeline fails to start, logs will not be collected.
Namespace Configuration
- Logs may not appear for certain namespaces if they are disabled in the ConfigMap.

Enable Logs in Manifest
- Edit the manifest and set logs.enabled to true.
- Update the endpoint with your OpsRamp portal URL:
```
logs:
  enabled: true
  endPoint: "https://<opsramp-portal>.api.opsramp.net"
```
Enable Log Management in Portal
- Go to Client Details Page > Log Management.
- Ensure Enable Log Management is set to Yes.
Verify Pipeline Status
- Confirm whether the logs pipeline has started.
- Check agent logs to validate that the OpenTelemetry pipeline is running.
Review Namespace Configurations
- If logs are missing from specific namespaces, edit the ConfigMap to include or exclude namespaces as required:
```
kubectl edit configmap <k8s-log-configmap> -n <namespace>
```
- Adjust the configuration as needed for infrastructure metric collection.
Cross-check in Portal
- Navigate to the Logs section in the OpsRamp portal.
- Verify pod logs and, if configured, syslogs are visible.

Symptom	Cause	Fix
Multi-line entries are not combined.	Incorrect `line_start_pattern`.	Test the regular expression against the actual log lines and update the pattern if necessary.
The rule does not match the expected pods.	Typo in the pod or deployment name.	Run `kubectl get deployments -n <namespace>` to verify the exact deployment name.
Too many logs are combined into a single entry.	The pattern is too broad (for example, `^.*`), or a global rule is affecting unrelated applications.	Use a more specific pattern and limit the rule by specifying `pods` and/or `namespaces`.
The rule matches unintended pods.	Pod names have similar prefixes.	Add `namespaces` or `containers` filters to narrow the rule.
Configuration changes are not applied.	The ConfigMap has not yet been reloaded.	Wait a few minutes for automatic synchronization, or restart the agent pod if required.
All log lines from a pod are merged into one large entry.	A global rule's pattern does not match that pod's log format.	Remove the global rule, or create a scoped rule for that pod. For more information, see Warning: the Risk of Global Rules.

Symptom	Likely Cause	Fix
Log pipeline fails to start	Invalid regular expression in `text`.	Check the agent logs to identify the invalid pattern, then correct the regular expression syntax.
Body is unexpectedly masked or cleared	A broad regular expression (for example, `.*`) is used with `redact_key` without scoping.	Set `attribute_type` to `resource` or `record` to prevent masking the log body.
Masking is not applied to the body	`attribute_type` is set to `resource` or `record`.	This is expected behavior. Remove `attribute_type` (leave it empty) to apply masking to the log body.
`partial` mode does not replace any content	The regular expression does not contain a capture group.	Add a capture group (`(...)`) around the portion of the pattern you want to replace.
Configuration changes do not take effect	YAML syntax errors or the ConfigMap resource version has not changed.	Validate the YAML configuration and check the agent logs for configuration or parsing errors.