Log aggregation
WorkFusion SPA has several components to aggregate logs from multiple servers. Thie article describes basic concepts of log aggregation.
Log aggregation in nutshell
Application writes log on the filesystem.
Filebeat component reads the application log and forwards it to the log aggregation server.
Logstash on the log aggregation server receives log events from Filebeat and stores lines on the filesystem in predefined structure.
By default, WorkFusion SPA 9.2 collects all component logs on PM server in the /logs directory. All application logs remain both on source and PM servers but with different retention policies.
Aggregated logs directory structure
Logs are stored with the following convention: <INSTALL_DIR>/logs/<SERVER_GROUP>/<hostname>/<component>/<date>/filename.log
Example:
/opt/workfusion/db/db.workfusion.com/nginx/2018-10-25/nginx.err.log
| Element | Description | Example |
|---|---|---|
| install_dir | directory to put user files, logs, and configs | /opt/workfusion |
| server_group | alias for group of components | app, db, ocr, bi, rpa, vds_master |
| hostname | real hostname of the server that sends logs | db.workfusion.com |
| component | component name | wfagent, workfusion, nginx |
| date | date when a log event was created on the source server; the pattern is YYYY-MM-DD The date is created based on UTC time and thus might differ from the timezone configured on the server. | 2018-11-30 |
| filename | log file name | metrics.log, status-agent-error.log |