Often, log files, especially system logs such as syslog or journald, have heightened read-permissions blocking Datadog agent log collection as it does not have sudo or admin access.
There are three potential solutions to get around this:
- (Not Recommended) Give the agent root access so it can tail those files. Datadog strongly recommends against going this route.
- Change the file permission to let the Agent access it.
- Configure an open source log shipper (such as Rsyslog, NXLog, …) that has root access to send those logs either directly to your Datadog platform or locally to a running Datadog agent. All configuration are explained in this article: https://help.datadoghq.com/hc/en-us/articles/115005086506-How-to-Send-Logs-to-Datadog-via-External-Log-Shippers