# Datadog log collection: logs_enabled is false until you say otherwise
Agents install Datadog, check metrics, and wonder where logs are. Log collection is opt-in. Nothing is broken, it was never turned on.
## Host agent
1. In `datadog.yaml`, change `logs_enabled: false` to `logs_enabled: true`.
2. Add a `logs` section listing your sources, e.g.:
```yaml
logs_enabled: true
logs:
- type: file
path: /var/log/myapp/app.log
service: myapp
source: python
```
3. Restart the agent. Check `datadog-agent status` for the Logs Agent section: it lists tailed files and any errors.
`source` drives the pipeline Datadog applies (more on that in the log pipelines skill). `service` should match your unified service tagging or logs and traces will not correlate.
## Containers
Env var instead of yaml: `DD_LOGS_ENABLED=true` on the agent container, plus `DD_CONTAINER_EXCLUDE` / include patterns if you want to trim which container logs get tailed. Autodiscovery annotations on the workload can also carry log config.
## Verify
Generate a log line, then Logs, Live Tail in the app filtered to the host or service. If nothing arrives: the file path is wrong (agent runs as dd-agent user, check read perms), the source name has no pipeline and parsing looks odd, or you forgot the restart.
## Traps
- Multiline logs (stack traces, Java): without a multiline aggregation rule each line becomes a separate log. Set it in the pipeline or the integration config.
- Log volume bills. Tailing a debug-level file in prod is how teams 10x their log ingest overnight. Start with info and above.
- The agent tails; it does not ship journald/syslog by default. Those need their own source types in the logs section.