Log Collection Plugin in ObserveOps
The Log Collection Plugin in ObserveOps lets you collect logs remotely from devices without installing MotaAgent on them. The device does not need to be added as a monitored resource. ObserveOps reaches out to the device at a configured interval and pulls the logs using the protocol you specify.
Prerequisites
- You have access to Settings > Observability Pipeline.
- You have a Runbook configured for log collection, or you create one during setup.
- The target device is reachable from the ObserveOps server.
How It Works
A Log Collection Profile defines the connection details, collection protocol, and log parser for a remote log source. ObserveOps uses the profile to poll the device at a set interval. Collected logs go through the standard Observability Pipeline: they are parsed, processed, and stored according to your index rules.
The Log Collection Plugin Screen
Go to Settings > Observability Pipeline > Log Collection Plugin.
The list shows all configured profiles with their fields:
| Column | What It Shows |
|---|---|
| Profile Name | The name of the collection profile |
| Description | A short description of the profile |
| Collection Type | The protocol used to collect logs |
| Log Parser | The parser assigned to this profile |
| Collection Status | Whether ObserveOps is successfully reaching the device |
| Status | Whether log collection is active |
| Action | Edit or delete the profile |
Create a Log Collection Profile
Click Create Log Collection Profile in the top right corner.
Fill in the form:
| Field | Description |
|---|---|
| Profile Name* | A unique name for this log collection profile |
| Description | Optional. A short description of the profile. |
| Collection Type* | The protocol to use for log collection. Select from the available protocols in the dropdown. |
| Log Parser* | The log parser type to apply to collected logs. If you leave this blank, collected logs appear under the Other category in Log Explorer. |
| Runbook* | Select an existing Runbook to use for collection, or click Create Runbook to build one from this screen. |
| Collection Interval* | How often ObserveOps polls the device for new logs. |
| Timeout* | How long ObserveOps waits before aborting a collection attempt if the device is unreachable. |
Click Create Log Collection Profile to save. Click Reset to clear the form.
Example
A network switch does not support MotaAgent installation. You create a Log Collection Profile with Collection Type set to SSH, assign the appropriate Runbook for SSH log retrieval, and set the interval to 5 minutes. ObserveOps polls the switch every 5 minutes and pulls the latest log entries through the pipeline.
Troubleshooting
Collection Status shows an error
Cause: ObserveOps cannot reach the device using the configured protocol and credentials.
Fix: Verify the device's IP is reachable from the ObserveOps server. Confirm the Runbook has the correct connection details and credentials. Check for firewall rules blocking the collection protocol.
Collected logs appear under the "Other" category in Log Explorer
Cause: No Log Parser was selected when creating the profile.
Fix: Edit the profile and select the correct parser for the log format. The parser determines the log type that ObserveOps assigns.
Collection is not triggering at the configured interval
Cause: The profile status is disabled, or the Runbook has an error that prevents execution.
Fix: Check that the profile Status toggle is on. Open the Runbook and verify it completes without errors in a test run.