Logs Partition

Log Partitions in LogicMonitor give you more control over how long different types of log data are stored. You can assign custom retention periods based on the business value or compliance needs of each log type.

For example, you can keep high-volume application logs for just a few days if they’re only needed for short-term troubleshooting. At the same time, you can retain critical logs—like Windows audit or compliance logs—for several months. This flexibility helps you manage log storage more efficiently and predictably.

LogicMonitor offers four retention options as follows:
7 Days, 1 Month, 90 Days, and 1 Year.

In addition to flexible retention, Log Partitions help you:

• Set storage limits per partition
• Enable automatic shut-off controls to avoid overages
• Improve search performance by narrowing the query scope

Log Partition allows you multiple logs subscription type within the same portal. Use Logs partition to segregate logs within your company based on tenant ID. If you are a Managed Service Provider (MSP), you can use Logs Partition to create logs partition for your tenants and set logs retention period as required by the tenants. As a MSP customer, you can create one logs partition for each tenant, which in most cases equates to “customer_name”.

If you are an enterprise customer, you can retain logs in logs partition for a longer or a shorter duration based on the type of logs. For example, you may decide to retain sensitive logs for a longer duration and test logs for a shorter duration. Pre-defined retention period options are available for logs partition.

With Logs Partition, a default logs partition is available out-of-the box. The Default logs partition follows the maximum retention value that has been purchased. However, you can change default partition’s retention period.

Requirements for Logs Partition

The following are the requirements for Logs Partition.

• Tenant identifier – To set the tenant identifier, go to Portal Settings, and in Tenant Identifier Property Name, add the name that is used while creating the custom property. For more information, see Tenant Identifier Property Name.
  
• Custom properties on Resource Groups – Create a custom property at the resource group level in the Resource Tree. This is used as identifying value of the partition you create. Refer to the following example of custom property where a property name is Customer with a value customer_a.
   
  Follow these guidelines while providing property and and value:
  • Don’t mix cases: User vs user—stick to lowercase.
  • Don’t use vague or source—specific field names like cstmra vs customer_acme.
  • Avoid overly verbose or abbreviated field names unless industry-standard.
    For more information, see Manually Assigning or Editing Properties. 
• Adding tenant.identifier property on resource automatically generates system.tenant.identifier property. For example, if the tenant identifier property name is set to Customer in the Portal Settings, the portal uses the value of Customer to generate system.tenant.identifier property value. Note: If system.tenant.identifier value is configured on individual resource rather than on resource group, logs partitions may not work properly.
• User access – Configure appropriate user role permissions on resource groups assigned to each tenant to avoid accidental reads of logs of other tenants. For more information, see User Access Control for Logs Partition.

Creating Logs Partition

1. In LogicMonitor, navigate to Logs > More options > Settings.
   
2. From the Settings page, under Partitions, select the Add Partition button.
   
3. On the Add Partition panel, add the following information.
   • Partition name – Add a name for the partition.
   • Tenant identifier -Select the tenant identifier from the list. The tenant identifier values are populated from the resource groups.
   • Subscription SKU – Select the subscription plan. The following options are available:
     • LM Logs Enterprise Monthly Retention
     • LM Logs Enterprise Yearly Retention
     • LM Logs Enterprise 7 Day Retention
     • LM Logs Enterprise 90 Day Retention
   • Retention – Select a retention period for the logs. The defaults options are 1 week, 1 month, 3 months, 1 year and Custom retention.

• Description – (Optional) Add a description for the partition.
  

4. Toggle the Ingesting switch to start the log ingestions, and select the Save icon to save the partition.

Editing Logs Partition

You can change the retention period, logs partition description, and start or stop logs ingestion for an existing logs partition.

1. In LogicMonitor, navigate to Logs > More options > Settings.
2. From the Settings page, under Partitions, select the log partition you want to edit.
3. From the Edit Partition panel, do the following:
   • Subscription SKU – Select the subscription plan. The following options are available:
     • LM Logs Enterprise Monthly Retention
     • LM Logs Enterprise Yearly Retention
     • LM Logs Enterprise 7 Day Retention
     • LM Logs Enterprise 90 Day Retention
   • Retention – Select a retention period for the logs. The defaults options are 1 week, 1 month, 3 months, 1 year and Custom retention.
   • Description – (Optional) Add a description for the partition.

4. Toggle the Ingesting switch to start the log ingestions, and select the Save icon to save the partition.

Starting or Stopping Log Ingestion in a Logs Partition

1. In LogicMonitor, navigate to Logs > More options > Settings.
2. From the Settings page, under Partitions, select the log partition you want.
3. From the Edit Partition panel, turn on or off the Ingesting toggle to start or stop ingesting logs in the logs partition, and then select the Save icon.
4. Alternatively, from the logs partition list, select the logs partition, and turn on or off the Ingesting toggle.

Deleting a Logs Partition

To delete a logs partition, you must stop logs ingestion for the logs partition and wait for the configured time. After you delete a logs partition, the existing logs from the logs partition will be permanently deleted.

1. In LogicMonitor, navigate to Logs > More options > Settings.
2. From the Settings page, under Partitions, select the log partition you want to delete.
3. From the Edit Partition panel, select the Delete icon.

User Access Control for Logs Partition

You need to have global Manage permission on Partitions and global Manage permission on resource groups to create, view, and manage logs partition. In addition to Partitions view permission, tenant resource group View permission would be used for viewing and searching logs in the logs partition.

To assign view or manage permission for logs partition:

1. In LogicMonitor, Settings > Users & Roles > Add Roles.
2. On the Logs & Traces tab, for Partitions, select the permission you want to assign to the role, and select Next: Finish.
   

User Access Control for Logs Partitions based on Resource Group

Refer to the following points to understand how resource group permissions are inherited for logs partitions permissions:

• If you have global manage permission on all logs partitions and have global permission to manage all resource groups, you can create, view, and manage logs partitions. You can also stop and start ingestions for logs partitions if you have these permissions.
• To search using log query, you need to have the following permissions:
  • Logs view permission
  • Global view permission on logs partitions
  • View permission for their corresponding resource group configured with tenant.identifier
• Users having view access on all logs partitions and view access on resource group configured for the respective tenant, can view the partitions and search logs in partitions.