FAQ

General

Does the agent need inbound ports?

No. It only makes outbound HTTPS connections to logcore.lsofito.com on port 443.

How much does the agent use?

Very little. It's a single Go binary with no runtime dependencies, and it sends data in compressed batches. Usage grows with the number of lines per second and the complexity of your regexes. logcore-agent status shows how much it's processing.

What happens if the network goes down?

The agent keeps up to 5,000 lines in memory and pauses reading files while the queue is full. It retries with backoff, waiting up to 60 seconds between attempts. When the connection returns, it continues from where it stopped. Nothing is lost unless the agent itself is stopped while lines are still queued.

Can I use one API key on many servers?

Yes. A key identifies the organization, not a server. You might still use separate keys per environment so you can rotate them independently.

How do I move a server to another organization?

Re-run the install command with an API key from the other organization, or edit api_key in logcore.yaml and restart the agent.

Logs

Why don't I see old log lines?

By default, the agent sends only lines written after it starts following a file. To import existing content the first time a file is found, set logs.start_position: beginning in logcore.yaml. This doesn't apply to files the agent already has a saved position for.

Can the agent read journald or Windows Event Log?

Not yet. The agent reads log files. On most Linux systems, /var/log/syslog or /var/log/messages has the same content as journald. See the syslog example.

Is the log timestamp parsed from the line?

No. The agent stamps each line with the time it read it, which is usually within a second of when it was written.

How do I stop sending a noisy line?

Add an exclude regex to the service file and restart the agent.

Can one file belong to two services?

Avoid it. Each service follows its files on its own, so the same lines can be sent once per service.

Where do I put service files for many servers?

Manage the services/ folder with your configuration tool (Ansible, Puppet, Chef, Salt) and restart the agent when files change.

APM

Do I need the agent for APM?

No. Apps can send directly with an API key. Sending through the agent saves you from putting the key in every app and adds the host name automatically.

Is there a Logcore tracing library?

No. Logcore uses standard OpenTelemetry, so you can switch backends without touching your code.

Which OpenTelemetry signals are supported?

Traces, metrics and logs, over OTLP/HTTP (protobuf or JSON) and OTLP/gRPC.

How do I reduce trace volume?

Use sampling in the SDK, for example OTEL_TRACES_SAMPLER=parentbased_traceidratio and OTEL_TRACES_SAMPLER_ARG=0.2, or in an OpenTelemetry Collector.

Data

How long is data kept?

Data	Default retention
Logs (agent and OTel)	7 days
Host metrics	30 days
Traces and OTel metrics	7 days

Who can see my data?

Only users in your organization. Every query is scoped to the organization of the signed-in user or API key.

Can I export data?

Yes. Use Reports → Export CSV for the filtered range.