Configure log sources
The agent collects logs from two places: the systemd journal (journald)
and log files you list. Both are controlled in /etc/atherops/config.yaml.
You never edit raw OpenTelemetry Collector YAML. The agent renders that for you
and restarts the collector when the config file changes.
Add a log file
Edit /etc/atherops/config.yaml and add paths under collection.logs.files.
Globs are allowed.
collection:
logs:
journald: true
files:
- /var/log/syslog
- /var/log/nginx/access.log
- /var/log/app/*.log
Save the file. The agent picks up the change and restarts the collector automatically, with no manual reload. Confirm in the logs:
journalctl -u atherops-otel-agent -f
level=info msg="config reloaded, restarting collector"
Each file source starts reading at the end of the file (start_at: end), so you collect new lines going forward, not the entire backlog.
Disable journald (non-systemd hosts)
On a host without systemd, the journald receiver cannot start. Set the flag to
false:
collection:
logs:
journald: false
files:
- /var/log/messages
When journald: false, the agent leaves the journald receiver out of the
collector entirely and the logs pipeline uses only your file sources. This is
honored. The config file controls it; you do not need to touch any collector
YAML.
With journald: false and no files, there is nothing to feed the logs pipeline.
How log fields map
Logs are sent to AtherOps as OTLP and stored with these fields:
| In AtherOps | Comes from |
|---|---|
message | the log line body |
level | the log severity (defaults to info if none) |
source | the originating service name, else unknown |
labels | other attributes on the record |
The platform always sets org_id, host_id, and the host node name itself. See Multi-tenant isolation. Any attribute named
org_id, host_id, instance, or node in your payload is dropped, so it can
never spoof tenant identity.