Datadog Log Management Fundamentals free question 3 / 10 · Domain 2: Log Collection
You installed the Datadog Agent on a Linux host, and its metrics are arriving. To send an application's logs, you wrote a type: file entry in a configuration file for the application and restarted the Agent, but no logs arrive. Following the host Agent steps, what should you check first?
- Whether an index to store these logs was created in Datadog beforehand
- Whether enabled: true is set under logs in the application configuration file
- Whether a separate API key was created and configured for sending logs
- Whether logs_enabled is set to true in the main datadog.yaml file
Show the answer and explanation
Answer: D
Why this is correct
The section "Activate log collection" says that collecting logs is not enabled by default in the Datadog Agent. To enable log collection with an Agent running on your host, you change logs_enabled: false to logs_enabled: true in the Agent's main configuration file, datadog.yaml. With environment variables, the same switch is DD_LOGS_ENABLED=true. The page then says that after activating log collection, the Agent is ready to forward logs, and the next step is to configure where to collect logs from. A source configuration on its own is therefore not enough to send anything.
Why the other options are wrong
"Whether enabled: true is set under logs in the application configuration file" … The application configuration file describes the source, with keys such as type, path, service, and source. Turning log collection on happens in the Agent's main configuration file, not in this file.
"Whether an index to store these logs was created in Datadog beforehand" … An index decides which logs are kept after they reach Datadog. The host Agent steps go from activating log collection to configuring the sources, and an index is not part of what makes the Agent forward logs.
"Whether a separate API key was created and configured for sending logs" … The host Agent steps are to activate log collection in datadog.yaml and then to configure where to collect logs from. Creating another API key is not one of these steps.
Key point
Metrics arriving while logs do not is the typical sign that log collection is still at its default of disabled. If the Agent runs in Kubernetes or Docker, the page sends you to the dedicated Kubernetes Log Collection or Docker Log Collection documentation, because the way to enable it is different there.