Log Inventory

Overview

Motadata AIOps provides you the facility to specify the type of the log that arrives from an unknown source in advance. This enables the system to identify the logs coming from the unknown source and assign appropriate parser to the log source so that the incoming logs can be parsed correctly and ultimately placed into the appropriate category.

When the logs come from an unknown source, any one of the following two options can happen:

• In case you have already configured the source in the log inventory and assigned a parser to the source, the logs will be parsed with the selected parser and the logs will move into the right category based on the Type of the device configured and the parser assigned to the device in the log inventory .

• In case the source is not configured in the log inventory, the logs arriving from that source will be placed in the 'Other' category. A record corresponding to this unknown log source is created in the Log Inventory when the logs arrive from this unknown source. Once we assign type to this unknown log source and assign a parser to this log source in the log inventory, the new logs that arrive from the same source from that moment onwards will be parsed with the selected parser and the logs will move into the right category based on the Type of the device configured in the log inventory.

note

You can create a record corresponding to the unknown log source in advance in the Log Inventory to ensure that the logs that arrive from the source are parsed right away and are not moved into the 'Other' category.

Navigation

Go to the Main Menu, Select Settings . After that, go to Log . Select Log Inventory. The log inventory list is now displayed.

Log Inventory Screen

The following fields are available on the Log Inventory screen:

Field	Description
Source	The IP address of the source.
Source Type	The type of the log source.
Assigned Parsers	The count of parsers assigned to the log source.
Category	Select the category that best describes the type of logs you are ingesting from the log source. This helps in organizing and managing different types of logs effectively.
Group	Select the appropriate group for the log source.
Actions	We will discuss all the actions available for log inventory in detail below.

Assign Log Parser

You can assign a log parser to a log source in the log inventory. When a log parser is assigned to a log source, all the logs from that source are then parsed using the parser assigned.

You should assign a parser to an unknown log source by creating a record in the log inventory for that source in advance if you know that you will be receiving logs from that source in the future. In case you do not create a record in the log inventory for this unknown source, a record will be created for you in the log inventory when the logs are received in the AIOps server. These logs will be placed in the 'Other' category.

Once we assign Type to this unknown log source and assign a parser to this log source in the log inventory, the new logs that arrive from the same source from that moment onwards will be parsed with the selected parser and the logs will move into the right category based on the Type of the device configured in the log inventory.

Click on against the log source to which you want to assign a log parser. Select Assign Log Parser to display a list of parsers you can assign to the log source.

Now, check the box against the parser(s) that you want to assign to the log source and then click on Assign Log Parser button to assign the parser to the log source.

Remove Assigned Log Parser

You can also remove the parsers already assigned to a log source. The logs that are already parsed will remain parsed with the same parser even if you remove the assigned parser.

Click on against the log source for which you want to remove a log parser. Select Remove Assigned Log Parser to display the list of parsers assigned to the log source.

Now, check the box against the parser(s) that you want to remove from the log source and then click on Unassign Log Parser button to remove the assigned parser from the log source.

Edit Log Inventory

You can edit the details of a log source in the log inventory.

Click on against the log source that you want to edit. Select Edit Log Inventory . A pop-up is displayed on the right side of the screen with all the details of the log source.

Now you can edit the log source details on this screen.

Assign Log Source Time Zone

When ingesting logs into Motadata AIOps, it’s essential to consider the time zone of the log source. If the logs originate from a different time zone than the one where the user is currently logged into the system, specifying the correct time zone for the log source is crucial to avoid any confusion and ensure accurate log analysis.

Steps to Assign Log Source Time Zone

To assign the time zone of the log source in the log inventory, follow these steps:

1. Navigate to the Log Source in the Log Inventory for which you need to assign the timezone.

2. Click on against the log source that you want to edit. Select Edit Log Inventory .

3. In the edit inventory screen, locate the field labeled Source Time Zone. Select the appropriate time zone for the log source from the dropdown menu.

4. Select Update Log Inventory to save the changes and update the log inventory.

When to Assign a Log Source Time Zone?

• Different Time Zones: Assign the log source time zone if the logs are being ingested from a different time zone than the user’s local time zone.
• Same Time Zones: If the log source and the user are in the same time zone, NO action is required as there will be no time zone conflict.

By accurately assigning the log source time zone, you ensure that the timestamps in the logs are correctly interpreted and displayed, avoiding any potential confusion that may arise from time zone differences. This practice helps in maintaining precise log data analysis and improves the overall effectiveness of log monitoring within Motadata AIOps.

Create Record for an Unkown Log Source in the Log Inventory

You should assign a parser to an unknown log source by creating a record in the log inventory corresponding to that source in advance if you know that you will be receiving logs from that source in the future. The assisgned parser will then be used to parse the logs received from this unkown log source.

Click on to create a record for an unkown log source in the inventory.

Enter the following details on the Log Inventory screen:

Field	Description
Source	Enter the IP address of the unknown source from which you expect to receive logs in the future.
Type	Select the type of the source device from the drop-down.
Groups	Select the group to which the source device belongs.
Log Parser Name	Select the log parser that you want to assign to the log source.

After entering all the details, click on Create Log Inventory to create the record corresponding to the log source in the inventory and assign a log parser to the source.

Select Reset to erase all the current field values entered in the pop-up, if required.