60+ predefined log types | FSO Agent log collector | 7–90 days search retention | Per GB add-on licensing by volume |
AppLogs is the log management capability of Applications Manager. It collects, parses, indexes and searches application and server logs from one search page, alongside metrics and traces. Logs are collected by the Full Stack Observability (FSO) Agent (source).
| Item | Detail |
|---|---|
| Collector | AppLogs sub-agent inside the FSO Agent |
| Predefined log types | 60+ (IIS, Apache, Windows Event Logs, Kubernetes, MySQL, PostgreSQL, SQL Server, middleware) |
| Custom log types | Supported, for non-standard or proprietary formats |
| Trial | “Try Now” from v180700: one-time, 5 GB default limit, no reactivation |
| Primary use cases | Troubleshooting and RCA, compliance and audit, security events, performance analysis |
Logs travel from a sub-agent on each monitored server to the Applications Manager server, where they are parsed, indexed and stored locally.
| Logs are indexed and stored on the Applications Manager server | ||||||
| Monitored server | Applications Manager server | |||||
AppLogs sub-agent In the FSO Agent Reads profile paths | Receive logs | → | Parse Format set by the log type | → | Index Faster search and retrieval | |
↓ | ↗ | ↙ | ||||
Filter and batch Source line filter Upload 30 s or 40 MB per log type | AppLogs Search Query and filter by time and field | ← | Local store Zip every 7 days Kept 7 to 90 days | → | Usage alerts Warning at 80% per log type | |
The agent filters and batches at source. The server then reads the uploads, parses by log type, indexes, and serves search and usage alerts from the same store (user guide, FSO Agent guide, FAQ).
| Module | Role |
|---|---|
| FSO Agent | Unified agent on the Windows or Linux server (from v175500); sends performance data every 5 minutes |
| AppLogs sub-agent | Log collector inside the FSO Agent; enable at install or under Settings › FSO Agent › SubAgents (Enable, Disable, Restart, Upgrade, Report) |
| Log type | What to fetch format definition used to parse entries (60+ predefined or custom) |
| Log profile | Where to fetch links a log type to file paths and servers; sets retention and collection limits |
| AppLogs Configuration | Log Profiles, Log Types and Settings tabs: global retention, zip interval, read interval, warning threshold |
| AppLogs Search | Keyword and field search; filter by time, source, host, severity and response code |
1 Deploy FSO Agent With the AppLogs feature | → | 2 Enable AppLogs Sub-agent | → | 3 Select / create Log Type What to fetch | → | 4 Configure Log Profile Where to fetch; log type syncs to associated servers | → | 5 Search and analyze Logs persisted per retention |
| Category | Operators |
|---|---|
| Logical | and, or |
| Comparison | equals, !=, <, >, <=, >= |
| Text match | contains, notcontains, startswith, like |
| Set | in, notin |
| Empty check | IsEmpty, IsNotEmpty |
| Aggregation | count, count_distinct, sum, min, max, avg, sd |
| Grouping and limits | groupby, timeslice, limit |
| Pipe | | |
Ready-to-use AppLogs search queries for common troubleshooting scenarios. Replace the sample values (transaction ID, service, server) with your own.
AppLogs data lives on the Applications Manager server itself: logs are parsed and indexed, then compressed on local disk. Search is served from that index. Retention, not licence, drives disk use (retention KB, configuration guide).
| Setting | Behaviour |
|---|---|
| Global retention | 7 15 30 60 or 90 days; expired logs are deleted automatically |
| Per log type retention | Overrides global value via Search Retention (days) on the log type |
| Zip indexed data every | Compresses indexed data; default every 7 days |
| Read AppLogs data every | Server pulls agent data; recommended 2 min (min 1, max 5) |
| Agent upload | Every 30 seconds or 40 MB per log type, whichever comes first (FAQ) |
| Disabling the sub-agent | Stops new collection; existing data stays until retention expires |
| Usage alerts | Warning threshold default 80% per log type; optional email on Warning, Critical or Clear |
AppLogs is licensed by log volume uploaded per monthly billing cycle, in GB. It is separate from the monitor-based Applications Manager licence (FAQ).
| Question | Answer |
|---|---|
| What is metered? | GB of log data uploaded in the billing cycle |
| Does retention affect consumption? | No; only uploaded volume counts |
| When does the limit reset? | Automatically at the start of each billing cycle |
| What if the monthly limit is exhausted? | New logs are not uploaded until the next cycle, or the limit is extended with add-ons |
| Trial without licence | “Try Now” from v180700: 5 GB default, one-time, cannot be reactivated (user guide) |
| Support contact for add-ons | appmanager-support@manageengine.com |
AppLogs scales on the Applications Manager server’s disk, not its memory: storage grows with monthly upload and retention, while AppLogs memory is capped at 320 MB (system requirements).
Storage is calculated per log type, then summed:
Storage (GB) = (Monthly upload (GB) ÷ 30) × Retention (days) × 0.5
| Monthly upload | 7 days | 15 days | 30 days | 60 days | 90 days |
|---|---|---|---|---|---|
| 50 GB | 5.83 GB | 12.5 GB | 25 GB | 50 GB | 75 GB |
| 100 GB | 11.67 GB | 25 GB | 50 GB | 100 GB | 150 GB |
| 250 GB | 29.17 GB | 62.5 GB | 125 GB | 250 GB | 375 GB |
| 500 GB | 58.33 GB | 125 GB | 250 GB | 500 GB | 750 GB |
| 1 TB | 116.67 GB | 250 GB | 500 GB | 1 TB | 1.5 TB |
Ingestion controls
Delivered, per public documentation:
| Version | Milestone |
|---|---|
| v175500 | FSO Agent (server monitoring agent) introduced (FSO Agent guide) |
| v179400 | AppLogs available as an FSO Agent sub-agent (user guide) |
| v180700 | “Try Now” limited trial for registered users without a licence |
| Listed in What’s new | “Centralized AppLogs monitoring” (What’s new) |