Docs

Torch Log Service

Data collection

Monitor LogCollector collection

This topic explains how to monitor LogCollector log collection status using the TLS alarm feature.

Background information

After enabling the LogCollector service log feature in the host group, TLS records state logs generated by LogCollector and stores them in the tls_service-project project under the tls_log-collector-status log topic. LogCollector status logs record informations such as the LogCollector version number, CPU usage, number of logs sent, number of failed requests, and files bound to multiple collection configurations. For more information, see LogCollector status logs.

You can create alarm tasks based on these fields to monitor the status of LogCollector log collection.

Alarm when a file is bound to multiple collection configurations

By default, a log file can only correspond to one collection configuration. If multiple configurations point to the same file, the system uses the latest collection configuration, and other configurations become invalid. The log entries in this log file are only collected into the log topic specified by the latest collection configuration.

To help you monitor this situation, the LogCollector service log offers the DuplicateFilePathCnt field, which indicates whether a log file is associated with multiple collection configurations. When the DuplicateFilePathCnt value is greater than 0, it means that a log file is associated with two or more collection configurations. By monitoring the DuplicateFilePathCnt field through the log alarm feature, you can quickly identify and resolve issues where a log file is associated with multiple collection configurations.

Select the region where log service is located from the top navigation bar.

On the left navigation bar, select log alarm > alarm policy.

On the Alarm policy page, and click Create alarm policy.

On the Create alarm policy page, configure the settings as needed.

For detailed instructions on alarm-related configurations, see Quickly configure log alarm.

Set up basic information.

Set the alarm policy name and project. The project must be set to tls_service-project.

Configure monitoring tasks.

Key parameter description:

Configuration	Description
Execute task	The relevant configuration information for monitoring task. The system executes the monitoring task periodically based on this configuration. Click Edit. In the Execute statement dialog box, complete the following configuration. Monitoring object: Log topic to be monitored. Set this to tls_log-collector-status Query statement: Query and analysis expression. Set this to DuplicateFilePathCnt > 0. Each task regularly uses this statement for query and analysis. For details on query and analysis statements, see Query overview and Analysis overview. Query time range: The time range of the data when each query and analysis statement is executed. Set to Last 1 Hour. Click Execution preview to view the query and analysis results for the specified time range. Click Reset.
Trigger condition	Determines whether the query and analysis result set meets the trigger condition. Set to Notify when there is data match, which means when the query and analysis result contains logs where DuplicateFilePathCnt > 0, a notification-level alarm is triggered.
Execution cycle	Execution cycle of the monitoring task, for example, set to execute once every 60 minutes.

Configure alarm notifications.

Key parameter description:

Configuration	Description
Alarm notification interval	The time interval for sending alarm notifications. When the alarm continues to trigger and reaches the specified threshold, TLS sends alarm notifications according to the set interval.
Notification group	Select the corresponding notification group. For more information, see Create notification group.

Receive alarm notifications.

You will receive an alarm notification when a log file is specified by multiple collection configurations.

You can click Log query details and then View details to open the query and analysis page for the tls_log-collector-status log topic. On the original log page, you can view log file names bound to multiple collection configurations and information about the corresponding machines.

Collection failure alarm

The SendFailReqs field in LogCollector service logs shows the number of failed log requests. If the value of this field is greater than 0, it means some logs failed to send. Monitor the SendFailReqs field with the log alarm feature of TLS to promptly detect and address log sending failures.

Select the region where log service is located from the top navigation bar.

On the left navigation bar, select log alarm > alarm policy.

On theAlarm policypage, and click Create alarm policy.

On the Create alarm policy page, configure the settings as needed.

For details about alarm-related configuration, see Quickly configure log alarm.

Set up basic information.

Set the alarm policy name and project. The project must be set to tls_service-project.

Configure monitoring tasks.

Key parameter description:

Configuration	Description
Execute task	The relevant configuration information for monitoring task. The system executes the monitoring task periodically based on this configuration. Click Edit. In the Execute statement dialog box, complete the following configuration. Monitoring object: Log topic to be monitored. Set this to tls_log-collector-status Query and analysis statement: The query and analysis statement. Set to SendFailReqs > 0. Each task regularly uses this statement for query and analysis. For details on query and analysis statements, see Query overview and Analysis overview. Query time range: The time range of the data when each query and analysis statement is executed. Set to Last 1 Hour. Click Execution preview to view the query and analysis results for the specified time range. Click Confirm.
Trigger condition	Determines whether the query and analysis result set meets the trigger condition. Set this parameter to Notify when there is data match, which means an alarm at the warning level will be triggered if any log entry in the query and analysis result contains SendFailReqs > 0.
Execution cycle	Execution cycle of the monitoring task, for example, set to execute once every 60 minutes.

Configure alarm notifications.

Key parameter description:

Configuration	Description
Alarm notification interval	The time interval for sending alarm notifications. When the alarm continues to trigger and reaches the specified threshold, TLS sends alarm notifications according to the set interval.
Notification group	Select the corresponding notification group. For more information, see Create notification group.

Receive alarm notifications.

If log sending fails, you will receive an alarm notification.

You can click Log query details and then View details to open the query and analysis page for the tls_log-collector-status log topic. In the Raw logs section of this page, you can view information about the machines that failed to send logs as well as the number of failed requests.

Last updated: 2026.05.26 11:31:26