Anypoint Monitoring Log FAQ

How can I obtain the Anypoint Monitoring log feature?

Anypoint Monitoring logging feature can only be obtained through Titanium or Integration Advanced Subscriptions. More information about Titanium Subscription can be found in MuleSoft Anypoint Platform Pricing. Please reach out to your Account Team for more information if you are interested in purchasing Titanium Subscription.

What are the storage limits for Anypoint Monitoring logs?

For Titanium Subscription, you will get 200 GB per each production core and 50GB per each sandbox core. Please note that the storage is shared globally, meaning that if you only have one production core, you will get 200 GB of storage that is shared across all apps. This storage is also shared across both logs and metrics usage.
You receive additional storage that is 10% of the size of purchased storage for indexes for searchable logs. The formulae for calculating indexable storage is 10% of (Num-vCore-prod *200 + Num-vCore-preProd*50) .

For more information, please refer to our official documentation Titanium Subscription Limits page.

What happens when the storage limit is reached?

Once the storage reaches its capacity, older logs will be deleted, starting from the earliest date, and the storage space will be returned to its original allocation.

Can we recover data that has been over-written or deleted?

Unfortunately, once the data has been deleted or over-written, currently we will be unable to recover the data.

What are the features of the Anypoint Monitoring Log?

Anypoint Monitoring Logging feature aggregate your log events so that you can manage, search for, filter, and analyze your log events.
For more information, please refer to our official documentation Logs in Anypoint Monitoring page.

How are the logs stored at the backend?

In Anypoint Monitoring, raw logs and searchable logs are stored separately. For more details, refer to the following links:
https://docs.mulesoft.com/monitoring/performance-and-impact#titanium
https://docs.mulesoft.com/monitoring/raw-data

Is it possible to delete logs for specific applications and dates by a customer?

No. It is not possible. Customers cannot delete logs.

Is it possible to delete logs for a specific application and dates by MuleSoft?

In cases where there is a risk of exposing sensitive data in the logs due to some reason, customers can raise a support case with MuleSoft. Requests to delete logs in any other case will likely to be rejected.

Note, when raising a support case consider the following:

Raw logs can be deleted from the backend based on specifications such as business groups, environments, applications, and dates;
Searchable logs cannot be filtered and deleted by business groups, environments and applications. The only option is to delete all logs under the Root Organisation for the specified dates, which means searchable logs for that period will be completely removed for all apps in all business groups;
Logs are deleted based on UTC timestamps

Is it possible to import the Monitoring logs data again from the backup after deleting it for a specific date?

No. It is not possible to import the logs back into the System.

Please note that everything listed above is subject to change. If you have any further questions, please raise a support ticket or reach out to your Account Team.

What happens to log data after downgrading or upgrading the subscription (i.e., from Titanium to Platinum or from Platinum to Titanium)?

The log data is lost and the storage that kept it is terminated within an hour. The reason is that the infrastructure changes and metrics will not be migrated over.
Log data is also lost when moving from a Titanium Trial to a Titanium subscription, as Trials are run from a multi-tenant cluster, which is different than the full Titanium experience which runs on dedicated single-tenant infrastructure.

Please consider thoroughly before making any decisions to change subscription. Make sure logs are preserved elsewhere.

What kind of connection does Anypoint Monitoring use to connect for RTF? How many connections does it use for RTF?

Each RTF app has a sidecar container that makes an individual connection to Anypoint Monitoring to send the logs. That means 1 connection per pod. However, each of these connections is a persistent connection.

What kind of subscription RTF needs for monitoring to work?

All platforms get a basic level of Monitoring with the base subscription based on our official documentation Data Storage and Retention. For RTF in general one needs a Platinum subscription. But certain features, e.g., logging requires Titanium.

Why is my application not showing in Anypoint Monitoring's log search filter picker?

This can be caused by the lack of the most recent log lines available and/or a large number of apps reporting recent logs. More information can be found at:

If we disable Anypoint Monitoring for a CloudHub 1.0 Application, will it stop logs from being forwarded to Anypoint Platform?

If Anypoint Monitoring for a CloudHub app is disabled by setting the property to:

anypoint.platform.config.analytics.agent.enabled=false

The logs will still be forwarded to the platform and be visible in the Anypoint Monitoring Logs UI.

Is it possible to disable Anypoint Monitoring log forwarding but keep metrics collection enabled?

The short answer is yes. Depending on the deployment target the steps are different:

CloudHub 1.0: CloudHub 1.0 | How to Disable Log Forwarding to Anypoint Monitoring Titanium Backend
CloudHub 2.0: private space and shared space
Hybrid/On-premise

Are mule_ee.log runtime logs available on Anypoint monitoring log search?

No, it is not currently feasible to view the on-premises Mule mule_ee.log file directly through Anypoint Monitoring's log search feature.

What Happens to Logs of a Deleted Application?

The logs stored in Anypoint Monitoring can still be retrieved using, for example, Anypoint Monitoring Archive API. The logs will be deleted following the storage-based retention at some point when the storage capacity is at it's limits.

Why is there a delay between UI data and raw API data showing up?

The raw data comes from an archive API, which is supported by an archival storage backend. A file is ready to be downloaded from the object store when it's either reaches an expected 9 minutes (or sometimes more), or when it reaches 10MB, whichever comes first. This is the difference between a real-time search engine powered UI versus a batch job powered API.