# What is AppLogs?

AppLogs is a log management capability in Applications Manager that enables you to collect, ingest, search, and analyze logs from applications and servers through a single, unified search interface. Logs are collected using the Applications Manager Full Stack Observability (FSO) Agent and are presented in a centralized view, making it easier to correlate and analyze log data across your environment.

Log monitoring, along with metrics and traces, is a core pillar of observability. AppLogs helps teams gain deeper visibility into system behavior, troubleshoot issues faster, and maintain operational, compliance, and security standards.

**Note:**

- The AppLogs feature is supported from Applications Manager **v179400 and above**.
- From v180700 onwards, Applications Manager offers support for **Try Now** option, which is a one-time, limited demo usage of AppLogs for registered users without a license, with a default usage limit of 5 GB. Once the limit is reached or the trial is disabled, it cannot be reactivated, and a valid license is required to continue using the feature.

- [Why use AppLogs?](https://www.manageengine.com/products/applications_manager/help/applogs.html#Whyuseapplogs)
- [How AppLogs works](https://www.manageengine.com/products/applications_manager/help/applogs.html#Howapplogsworks)
- [Getting started with AppLogs](https://www.manageengine.com/products/applications_manager/help/applogs.html#Startapplogs)
- [Deploying AppLogs](https://www.manageengine.com/products/applications_manager/help/applogs.html#Deployingapplogs)
- [What is a Log Type?](https://www.manageengine.com/products/applications_manager/help/applogs.html#logtype)
  - [Supported Log Types](https://www.manageengine.com/products/applications_manager/help/applogs.html#supportedlogtypes)
  - [Custom Log Types](https://www.manageengine.com/products/applications_manager/help/applogs.html#customlogtypes)
- [What is a Log Profile?](https://www.manageengine.com/products/applications_manager/help/applogs.html#logprofile)
- [Search, Query Language, and Analysis](https://www.manageengine.com/products/applications_manager/help/applogs.html#Querylanguage)
- [Stop Log Monitoring](https://www.manageengine.com/products/applications_manager/help/applogs.html#stoplogmonitoring)

## Why use AppLogs?

AppLogs helps you gain actionable insights from logs for the following use cases:

- **Troubleshooting and Root Cause Analysis:** Correlate logs with performance metrics and alerts to quickly identify the root cause of issues.
- **Compliance and Auditing:** Maintain an audit trail of application and system activities to meet regulatory and compliance requirements.
- **Security and Threat Detection:** Detect suspicious behavior, unauthorized access attempts, and security-related events.
- **Performance Optimization:** Analyze log patterns to identify bottlenecks, inefficiencies, and abnormal behavior that may impact application performance.

## How AppLogs works

AppLogs collects logs from monitored servers through the Applications Manager FSO Agent. Once logs are collected, they are:

- Classified based on their associated **log type**
- Parsed and indexed for faster retrieval
- Made available for searching, filtering, and analysis through the AppLogs Search page

This enables you to view and analyze logs from multiple applications and servers in one centralized interface.

## Getting started with AppLogs

To start using **AppLogs** in **Applications Manager**, follow the steps below to configure log collection and analysis:

1. [Deploy the FSO Agent](https://www.manageengine.com/products/applications_manager/help/manage-agent.html) on the required servers to enable data collection.
2. **Enable the AppLogs sub-agent** within the deployed FSO Agent to allow log monitoring. You can enable AppLogs monitoring in either of the following ways:
   - **During FSO Agent installation:**
     - **Windows:** AppLogs enablement is available as an option in the Windows InstallShield wizard. During the installation process, select the **Enable AppLogs Monitoring Agent** checkbox to enable AppLogs. No additional configuration is required after installation.
     - **Linux:** While installing the FSO Agent, enable the AppLogs sub-agent using the **Enable AppLogs Monitoring Agent** checkbox provided in the Linux installation steps in the Applications Manager UI.
   - **For an existing/onboarded FSO Agent:** Navigate to **Settings → FSO Agent** and enable the AppLogs sub-agent using the **SubAgents** option (![Sub Agent options icon](https://www.manageengine.com/products/applications_manager/help/images/subagent-icon.png)) under the Actions column for an individual agent, or use the **Bulk Actions** option to enable it for multiple agents at once.
3. [Select a Log Type](https://www.manageengine.com/products/applications_manager/help/supported-log-types.html) that matches the format of your application or system logs. If your log format is not available by default, you can define a [Custom Log Type](https://www.manageengine.com/products/applications_manager/help/add-log-type.html).
4. [Configure Log Profiles](https://www.manageengine.com/products/applications_manager/help/add-log-profile.html) to associate log types with specific log file paths and monitored servers.
5. **(Optional)** [Tune AppLogs settings](https://www.manageengine.com/products/applications_manager/help/applogs-configuration.html#settings) such as retention, ingestion frequency, and indexing behavior based on your requirements.

Once these steps are completed, AppLogs automatically begins collecting logs and makes them available for **searching, filtering, and analysis** through the AppLogs Search page.

## Deploying AppLogs

AppLogs is deployed as a **sub-agent** within the **Full Stack Observability (FSO) Agent** of **Applications Manager**. Once enabled, the AppLogs sub-agent allows Applications Manager to collect and monitor logs from applications and services running on the server.

You can view and manage the AppLogs sub-agent status from the FSO Agent management pages in the Applications Manager UI. The status indicates whether the sub-agent is enabled and shows the last communication time with the server.

To enable the AppLogs sub-agent for an existing/onboarded FSO Agent, follow the steps below:

1. Navigate to **Settings** from the top navigation bar.
2. Under **Discovery & Data Collection**, click on **FSO Agent**.
3. Under the **View Agents** tab, click on the **SubAgents** option (![Sub Agent options icon](https://www.manageengine.com/products/applications_manager/help/images/subagent-icon.png)) of an agent to open the **Sub Agent Management** panel.
4. From the **Chosen Agents** dropdown, confirm or modify the selected agent(s).
5. Click on **Enable AppLogs Monitoring**.

Once enabled, the AppLogs sub-agent begins reading and forwarding log data from the corresponding servers.

![AppLogs sub-agent](https://www.manageengine.com/products/applications_manager/help/images/applogs-sub-agent.png)

For more information on deploying and managing FSO Agents and sub-agents, refer to the [FSO Agent documentation](https://www.manageengine.com/products/applications_manager/help/manage-agent.html).

## What is a Log Type?

A [log type](https://www.manageengine.com/products/applications_manager/help/supported-log-types.html) defines the format in which an application writes its logs.

![AppLogs Log Types](https://www.manageengine.com/products/applications_manager/help/images/applogs-log-types.png)

Different applications—such as IIS, Apache, Cassandra, and MySQL—generate logs in different formats. Defining these formats as log types helps AppLogs:

- Correctly parse log entries
- Group logs from similar applications
- Enable faster and more accurate searching

If an application’s log format is not available by default, you can create a custom log type to suit your requirements.

### Supported Log Types

![AppLogs Supported Log Types](https://www.manageengine.com/products/applications_manager/help/images/applogs-supported-log-types.png)

AppLogs includes **60+ predefined log types** for commonly used platforms and services, including:

- IIS and Apache access and error logs
- Windows Event Logs
- Kubernetes audit and pod logs
- Database logs such as MySQL, PostgreSQL, and SQL Server
- Middleware and application framework logs

These predefined log types allow you to start collecting and analyzing logs quickly with minimal configuration.

### Custom Log Types

![Creating Custom Log Types](https://www.manageengine.com/products/applications_manager/help/images/applogs-custom-log-type.png)

Custom log types allow you to define log formats for applications or services that generate logs in non-standard or unique formats.

This is especially useful in environments such as:

- Microservices-based architectures
- Custom-built or niche applications
- Applications with proprietary logging formats

By defining a custom log type, you ensure that logs are parsed correctly and remain searchable and easy to analyze.

## What is a Log Profile?

A [log profile](https://www.manageengine.com/products/applications_manager/help/add-log-profile.html) associates a log type with specific log sources such as files or directories.

![Add Log Profile](https://www.manageengine.com/products/applications_manager/help/images/add-log-profile.png)

Log profiles define:

- Which logs should be collected
- How long logs should be retained
- Collection limits and advanced collection settings

Using log profiles, you can efficiently manage log collection across multiple servers and applications.

## Search, Query Language, and Analysis

![Search Log Types](https://www.manageengine.com/products/applications_manager/help/images/applogs-search-result.png)

AppLogs provides powerful search and filtering capabilities to help you analyze logs effectively. You can:

- Search logs using keywords and structured fields
- Filter logs based on time range and other available fields such as source, host/IP address, response code, severity, exception, error, and more
- Run advanced queries to narrow down results
- Perform quick investigations during incidents

These capabilities help you move from raw log data to meaningful, actionable insights.

## Stop Log Monitoring

In Applications Manager, AppLogs monitoring can be stopped only by disabling the **AppLogs sub-agent** on the required servers. Existing log data is retained and not removed.

You can disable the **AppLogs sub-agent** from the FSO Agent management page by navigating to **AppLogs → Deploy Agent →** selecting the **SubAgents** option for an agent, and clicking **Disable**.

![Sub Agent management disable](https://www.manageengine.com/products/applications_manager/help/images/sub-agent-disable.png)

- **Disable for individual agents:** Disable the AppLogs sub-agent for a single agent.
- **Bulk disable AppLogs sub-agent:** From the **Sub Agent Management** window, select multiple agents using the **Chosen Agents** dropdown (Select All Agents or search-based selection) and disable the AppLogs sub-agent in one action.

Once disabled, the agent stops reading and sending log data from the corresponding servers.