Skip to content
Agent Client Collector log policies › Agent Client Collector Log Analytics › Agent Client Collector › IT Operations Management
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Agent Client Collector Log Analytics default policies and checks

Agent Client Collector Log Analytics provides various default policies and checks.

Streaming log data from Windows hosts is supported in Agent Client Collector Log Analytics Version 3.1.0 and later.

Default ACC-L policies

NameOSDescriptionCheck
Apache on Linux LogsLinuxCollects logs from Apache servers running on a Linux OS and sends them to the MID Server for further analysis.log shipper
Apache on Windows LogsWindowsCollects logs from Apache servers running on a Windows OS and sends them to the MID Server for further analysis.log shipper
IIS logsWindowsCollects logs from Microsoft IIS web servers and sends them to the MID Server for further analysis.log shipper
JBoss/WildFly Application Server on Linux LogsLinuxCollects logs from JBoss/WildFly application servers running on a Linux OS and sends them to the MID Server for further analysis.log shipper
JBoss/WildFly Application Server on Windows LogsWindowsCollects logs from JBoss/WildFly application servers running on a Windows OS and sends them to the MID Server for further analysis.log shipper
Linux OS LogsLinuxCollects logs from the Linux OS and sends them to the MID Server for further analysis.log shipper
MSSQL on Linux LogsLinuxCollects logs from MSSQL DBs running on Linux and sends them to the MID Server for further analysis.log\_shipper
MSSQL on Windows LogsWindowsCollects logs from MSSQL DBs running on a Windows OS and sends them to the MID Server for further analysis.log shipper
MySQL DB on Linux LogsLinuxCollects logs from MySQL DBs on a Linux OS and sends them to the MID Server for further analysis.log shipper
MySQL DB on Windows LogsWindowsCollects logs from MySQL DBs running on a Windows OS and sends them to the MID Server for further analysis.log shipper
Nginx on Linux LogsLinuxCollects logs from Nginx servers running on a Linux OS and sends them to the MID Server for further analysis.log shipper
Tomcat on Linux LogsLinuxCollects logs from Tomcat servers running on a Linux OS and sends them to the MID Server for further analysis.log shipper
Tomcat on Windows LogsWindowsCollects logs from Tomcat servers running on a Windows OS and sends them to the MID Server for further analysis.log shipper
Oracle WebLogicWindows and Linux

Collects logs from Oracle WebLogic servers and sends them to the MID Server for further analysis.Note:

  • The log path that WebLogic uses has two environment variables, as described in the WebLogic documentation. For more information, see Environment variables.
  • On both Windows and Linux, Agent Client Collector Log Analytics adds a default environment variable from the WebLogic documentation to the log path. You can either use this default environment variable to get the full directory, or change it manually if you prefer to use a known direct directory. For information about customizing the environment variable, see Edit log path configurations.
log shipper
WebSphere Application Server on Linux LogsLinuxCollects logs from WebSphere application servers running on a Linux OS and sends them to the MID Server for further analysis.log shipper
Windows OS Event LogsWindowsCollects Windows event logs from Windows servers and sends them to the MID Server for further analysis.log shipper for win events

Environment variables

The log path used for collecting logs from certain servers may contain environment variables. It’s important to note that on Linux systems, the ACC Agent can only access environment variables that reside in the /etc/environment file. Add the environment variables that the agent must access to the /etc/environment file using the format <NAME>='<VALUE>'. On Windows systems, you can create environment variables in the usual manner.

Default ACC-L checks

Agent Client Collector Log Analytics (ACC-L) provides the following default Type=Log checks.

  • The log shipper check launches a background process that sends logs from servers to an agent data input, according to the check's configured log path. When access permissions are lacking or the log path is configured incorrectly, the system sends an alert to the instance. For proper log configuration, ensure that the servicenow user has permissions to access the configured log path on the machine that is hosting the agent, and that the log path is configured correctly.

  • The log shipper for win events check is similar to the log shipper check, but sends event logs from Windows OS servers to the agent data input.

    Note: To collect Security Windows event logs, servicenow users on an agent hosting machine must have admin privileges.