elastic / elastic/fleet-server
Send a (/var/log) directory listing to Fleet and display it on the Agent status page
- Dominant language
- Go
- Stars
- 113
- Forks
- 117
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 112
Description
Sometimes we need to gather more logs from our installed Agents but in the blind we are not always sure what is relevant and what not. The team that manages Elastic Stack does not always have access to the hosts where the Agents are running.
The system owner or sysadmin use sssd or sometimes they use shibolet for authentication of other different services. For security reasons we need to gather all relevant logs.
When we configure the Agent Integrations we would like to have a bit of visibility from the Agent beforehand.
It would be ideal to send a directory listing to Fleet and display it on the Agent status page,
e.g. /var/log. Could also be a list of directories. Default: []
On our former log storage solution we've had an Agent config flag that could have been set:
list_log_files:
- /var/log
We request something similar in Fleet and in the Agent configuration.
Extra nice perks:
Recently modified files where highlighted in a different color. To help even more on identifying active logs.
I'm thinking this could be pushed with the "Last activity" or health status
This used to look like this:


Contributor guide
Assessment
This issue has not been assessed yet.