Manage Serverless Agent Logs

As of serverless agent version 2.2.0, task logs and instrumentation logs are handled separately.

  • Task logs continue to be with whatever log setup you have on your task container.

  • Instrumentation logs go to a separate log group created by the serverless instrumentation installer:

    <stack_name>-SysdigServerlessLogGroup-<uid>.

    At this time, the log group name cannot be edited. By default, the logging level is set to info.

Logging Environment Variables

Set Logging Level

  • SYSDIG_LOGGING is used for instrumentation log level. Default = info.

    The full list of options are: silent | fatal | critical | error | warning | info | debug | trace

Log Forwarding

The instrumented workload will forward instrumentation logs to the instrumentation agent cloudwatch log group.

If by any reason you want to observe instrumentation logs in the log group of the workload you can set SYSDIG_ENABLE_LOG_FORWARD=false. You can do so, by manually going to ECS task definition and creating a new revision with a modified workload container definition that includes SYSDIG_ENABLE_LOG_FORWARD=false. After creating this revision you can then update your task in the cluster to deploy your new revision. This will in turn lunch a workload container that will NOT forward it’s logs.

When SYSDIG_ENABLE_LOG_FORWARD is set to true the workload will forward it’s logs to the agent’s cloudwatch log group by default, but if you want to capture those logs in a different system for later analysis, you can have your workload container forward it’s logs to an endpoint you set and all you need is to provide SYSDIG_LOG_FORWARD_ADDR and SYSDIG_LOG_LISTEN_PORT.

  • SYSDIG_ENABLE_LOG_FORWARD Default = true
  • SYSDIG_LOG_LISTEN_PORT Default = 32000
  • SYSDIG_LOG_FORWARD_ADDR Default = localhost:32000. Where the logwriter of the workload agent listens. Can be set to any other TCP endpoint.
  • SYSDIG_LOG_FORWARD_FORMAT Default = json. It defines the format of the forwarded instrumentation logs. The supported options are: text | json.

Advanced Configurations

  • SYSDIG_BUFFER_SIZE: Receiving buffer size in bytes for the TCP listener, which can be increased. Default 1024.
  • SYSDIG_DEADLINE_SECONDS: Connection deadline, which can be increased if clients are taking longer to connect. Default 3.

See other serverless agent environment variables here.