Manage File Logging for Agent Components

Sysdig Agent provides the ability to set component-wise log levels that override the global file logging level controlled by the file_priority configuration option. The components represent internal software modules and can be found in /opt/draios/logs/draios.log.

By controlling logging at the fine-grained component level, you can avoid excessive logging from certain components in draios.log or enable extra logging from specific components for troubleshooting.

To set component-level logging:

  1. Determine the agent component you want to set the log level:

    To do so,

    1. Open the /opt/draios/logs/draios.log file.

    2. Copy the component name.

      The format of the log entry is:

      <timestamp>, <<pid>.<tid>>, <log level>, <component>[pid]:[line]: <message>

      For example, the given snippet from a sample log file shows log messages from sdjagent, mountedfs_reader, watchdog_runnable, protobuf_file_emitter, connection_manager, and dragent.

      2020-09-07 17:56:01.173, 27979.28018, Information, sdjagent[27980]: Java classpath: /opt/draios/share/sdjagent.jar
2020-09-07 17:56:01.173, 27979.28018, Information, mountedfs_reader: Starting mounted_fs_reader with pid 27984
2020-09-07 17:56:01.174, 27979.28019, Information, watchdog_runnable:105: connection_manager starting
2020-09-07 17:56:01.174, 27979.28019, Information, protobuf_file_emitter:64: Will save protobufs for all message types
2020-09-07 17:56:01.174, 27979.28019, Information, connection_manager:282: Initiating connection to collector
2020-09-07 17:56:01.175, 27979.27979, Information, dragent:1243: Created Sysdig inspector

  2. Open /opt/draios/etc/dragent.yaml.

  3. Edit the dragent.yaml file and add the desired components:

    In this example, you are setting the global level to notice and component log levels for sdjagent, watchdog_runnable, protobuf_file_emitter, and connection_manager.

    log:
  file_priority: notice
  file_priority_by_component:
    - "connection_manager: debug"
    - "protobuf_file_emitter: notice"
    - "watchdog_runnable: warning"
    - "sdjagent: error"

    The log levels specified for components override global settings.

  4. Restart the agent.

    For example, if you have installed the agent as a service, then run:

    $ service dragent restart