FAQ: Anypoint Monitoring Logs, Metrics, Performance, and Limits

The expected CPU utilization from the Mule monitoring agent is less than 5% based on typical use. Anypoint Monitoring collects data asynchronously at a one-minute resolution, so monitoring activity does not block Mule runtime data processing. For deployment-specific configuration, see Configure and Enable Anypoint Monitoring for Mule Apps (CloudHub).

Raw log storage limits depend on your subscription tier:

Anypoint Monitoring creates indexes on raw logs to enable fast log search queries. The searchable storage allocation equals 10% of your total purchased storage, and Anypoint Monitoring indexes only the most recent logs up to that limit. Total searchable storage across your organization is capped at 6 TB regardless of the number of vCores or flows you purchased.

For Titanium subscriptions, calculate your total searchable storage allocation using this formula:

Storage per unit purchased varies by subscription tier:

For most organizations, the 6 TB cap is the binding limit regardless of vCore count.

To retrieve logs beyond the searchable index, use the Anypoint Monitoring Archive API.

When storage reaches capacity, the oldest logs are deleted first to reclaim space.

Retention for application metrics depends on your subscription tier:

Anypoint Monitoring retains enhanced API metrics for 30 days across all subscription tiers. These additional limits apply regardless of tier:

For Anypoint Integration Advanced and Titanium subscribers, Anypoint Monitoring retains custom metrics for 365 days in production environments.

Alert limits vary by alert type and subscription tier:

Starter and Gold/Platinum tiers have no allowance for custom dashboard alerts.

Anypoint Monitoring supports up to 10 Telemetry Exporter connections per organization for Anypoint Integration Advanced and Titanium subscribers.

No. Anypoint Monitoring doesn’t provide VPC-level network traffic metrics — such as total inbound or outbound bytes at the VPC or private space boundary. Anypoint Monitoring collects application-level metrics from Mule runtime, not from the underlying network infrastructure.

To estimate traffic volumes, use the Anypoint Monitoring Metrics API to query application-level inbound and outbound metrics per Mule application. See What attributes should I use to query application traffic data via the Metrics API? for the correct metric names.

Not directly. Anypoint Monitoring doesn’t provide a prebuilt report or dashboard view for monthly outbound traffic aggregated across all applications.

To estimate monthly outbound traffic, use the Metrics API to query mulesoft.app.outbound metrics for each application and sum the results. This provides application-level outbound message counts and data volumes as a proxy for network egress.

A Metrics API query can return a 200 OK response with "data": [] when the Connected App used to generate the Bearer token lacks the required environment-level scopes for the target environment.

To resolve this, grant the Connected App the following permissions for each business group and environment you want to query:

Without these permissions, the API returns empty data rather than a permission error. For details, see the Anypoint Monitoring Metrics API documentation.

Use the following metrics for application-level traffic data:

Don’t use endpoint.type or endpoint.operation as query attributes on the mulesoft.api.summary metric. These attributes were removed from mulesoft.api.summary. The same restriction applies to mulesoft.api.path, mulesoft.api.client_ip, and mulesoft.api.geo_location on that metric. For endpoint-level dimensions, use mulesoft.app.inbound and mulesoft.app.outbound instead.

You can access API analytics metrics data directly via the Anypoint Monitoring Archive API, available to Anypoint Integration Advanced and Titanium subscribers. The Archive API exposes your metrics data in a directory hierarchy you can navigate and download as files containing JSON objects, each representing one or more metric events. You can write an application to traverse the data and integrate it into your own system.

To also capture non-aggregated API events — which contain more detailed information about each API invocation — enable them by setting the following property:

Non-aggregated events are accessible under the raw file type in the Archive API.

No. The Anypoint Monitoring Archive API doesn’t support bulk export of custom metrics.

To retrieve application and API metrics via the Archive API, see How can I access API analytics metrics data programmatically?.

No. Anypoint Monitoring doesn’t aggregate application metrics across environments or business groups in a single dashboard view. Application-level metrics are scoped to individual environments. To aggregate traffic across environments, query the Metrics API separately for each environment and combine the results.

Anypoint Monitoring stores raw logs and searchable logs separately. Raw logs are stored in archival storage and can be scoped by business group, environment, application, and date range. Searchable logs are stored as indexes on top of raw logs to support fast queries, but cover only the most recent logs up to 10% of your purchased storage. For details, see Raw Data in Anypoint Monitoring and How does Anypoint Monitoring calculate searchable log storage?.

The maximum length for a single log line is 8 KB, including date and thread metadata. Lines longer than 8 KB are truncated at the 8 KB mark. To log data that exceeds this limit, split it into chunks that are each smaller than 8 KB.

No. You can’t delete logs directly. If sensitive data is exposed in logs, raise a support case with MuleSoft. MuleSoft accepts log deletion requests only when sensitive data is exposed.

The answer differs for raw logs and searchable logs.

Raw logs can be scoped by business group, environment, application, and date range (GMT). MuleSoft can delete a targeted subset of raw logs without affecting other data.

Searchable logs cannot be scoped by business group, environment, or application. Deletion is performed by dropping whole indices under the root organization. Under the current multitenant Log Search architecture on Hyperforce, a single searchable-log index can span several days, weeks, or months. The exact coverage depends on your stock-keeping unit (SKU), index size, and storage usage. As a result, the actual date range deleted will be equal to or larger than the range you request — in some cases by a significant margin.

Before executing the deletion, MuleSoft runs a dry-run of the operation and shares the cumulative date range that will be dropped, along with the list of affected indices, so you can confirm before proceeding.

No. After logs are deleted or overwritten, they can’t be recovered.

No. You can’t import logs back into the system after deletion.

Anypoint Monitoring and Runtime Manager are separate systems with independent log retention policies. Deleting an application in Runtime Manager does not immediately remove its logs from Anypoint Monitoring.

Logs stored in Anypoint Monitoring remain accessible after an application is deleted from Runtime Manager. Retrieve these logs using the Anypoint Monitoring Archive API. Anypoint Monitoring deletes the oldest logs first when storage capacity is reached. For details on Anypoint Monitoring storage limits, see What are the raw log storage limits for Anypoint Monitoring?.

Runtime Manager maintains its own log storage with separate limits and rotation behavior. For Runtime Manager log retention details, see Log Persistence (Anypoint Runtime Manager). If your apps are deployed to CloudHub 2, see also CloudHub 2.0 Logging FAQ.

No. You can purge application logs in Runtime Manager regardless of how the application is deployed. No specific deployment configuration is required. For instructions, see Viewing Log Data in Runtime Manager.

The Archive API is backed by an archival storage backend. A file becomes available for download when it reaches either 9 minutes of accumulation or 10 MB in size, whichever comes first. The delay between the UI and Archive API occurs because the Archive API’s batch process accumulates data before a file becomes available, while the UI uses a real-time search engine.

The app doesn’t appear in the filter when recent log lines are unavailable or when a large number of apps are reporting recent logs. For more information, see Not All Apps Are Showing in the Left Sidebar in Anypoint Monitoring.

No. You can’t view on-premises mule_ee.log files directly through Anypoint Monitoring log search.

Yes. If you disable Anypoint Monitoring by setting the following property:

Logs are still forwarded to Anypoint Platform and remain visible in the Anypoint Monitoring logs UI.

Yes. The steps vary by deployment target:

Each Runtime Fabric app has a sidecar container that makes one persistent connection to Anypoint Monitoring to send logs. Each pod uses one connection.

All deployment targets include a basic level of monitoring with the base subscription. Runtime Fabric requires a Platinum subscription for general monitoring. Certain features, such as logging, require a Titanium subscription. For details, see Understanding Performance Impact, Limits, and Data Retention.

Log data is lost and the storage that held it is terminated within an hour when you change subscriptions — for example, from Titanium to Platinum or from Platinum to Titanium. Log infrastructure changes are not migrated.

Log data is also lost when moving from a Titanium trial to a paid Titanium subscription, because trials run on a multitenant cluster that is separate from the dedicated single-tenant infrastructure used for paid Titanium.

Unlike log data, metrics data is retained for a grace period before removal:

To retrieve metrics data before it is removed, use the Anypoint Monitoring Archive API.