Log management

Metrics show that something is wrong; logs show why. otwatch can collect the logs of the OpenText platform centrally, make them searchable next to the metrics and raise alerts on log patterns. Log collection is set up per customer in the implementation project.

Log flow: logs are collected by Alloy, stored in Loki, searched in Grafana and evaluated by alert rules.

Supported log sources

Source	Examples
Content Server	Thread, connect and timing logs, agent logs
OTDS	Authentication, single sign-on and synchronisation events
Search	Admin server, update distributor, index and search engines
Web servers	Tomcat, IIS access and error logs
Operating systems	Windows event logs, Linux syslog / journal
Databases	Oracle alert log, PostgreSQL, Microsoft SQL Server
Kubernetes	Container logs

Collection and storage

Grafana Alloy collects logs on the hosts or in the cluster, parses them and adds labels (environment, host, component, log type, severity).
Grafana Loki stores logs compressed and indexes only the labels, which keeps storage requirements low.
Retention is configurable per log source, e.g. 30–90 days for operational logs and 12 months or longer for security-relevant logs.

Search and analysis

Logs are searched in Grafana with LogQL: label filters, free text, regular expressions and parsed fields. Example: all failed logins of the last hour in production:

{env="PROD", component="otds"} |= "failed" | logfmt

From a spike in a dashboard you can jump directly to the logs of the same component and time range.

Log-based alerting

The Loki ruler evaluates log queries continuously, for example a number of failed logins within a time window or repeated errors of a component. Log alerts use the same routing, priorities and maintenance windows as metric alerts.

SIEM