# System logs not collected on some Elastic Agent policies

**URL:** <https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426>\
**Category:** Elastic Agent\
**Created:** [January 7, 2026, 6:20pm UTC](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426 "2026-01-07T18:20:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nazok123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nazok123/32/146607_2.png) [@nazok123](https://discuss.elastic.co/u/nazok123)\
**Post date:** [January 7, 2026, 6:20pm UTC](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426/1 "2026-01-07T18:20:00Z")

</div>

Hi everyone,

We use Elastic as a SIEM. I have several Elastic Agent policies, and the same agents are assigned to multiple policies.

However, on some of the policies, system logs from the sources are not being collected, while on other policies everything works normally.

As a temporary workaround, I duplicated the working policy — and then the logs started to appear. But when I create a new policy from scratch and configure it the same way, it still does not work.

What could be causing this behavior, and how can I properly troubleshoot it?

Is there anything specific I should check in Fleet, integrations, or data streams?

Any advice would be appreciated — thank you!