Skip to main content

Logs

The Logs module is full-text search plus a live tail over everything the agents ship. What is collected, how secrets are scrubbed on the host, and how volume is capped is the agent's side of the story: Logs.

Searching​

Type into the search field: it matches message text, service names and hostnames. Combine with the host selector and the level chips (error, warning, notice, info, debug) to narrow down. The KPI strip (lines, hosts, errors over 24 hours) follows your current filter, so it answers "how much of this is there".

Saved views keep a filter combination one click away for the whole team: set your filters, save the view, and it appears as a chip for everyone.

Live tail​

The feed tails on its own while you stay on the page. A quiet host is not a frozen page: the live dot pulses on every poll with the time of the last check, so "no lines" visibly means "no lines", not "not looking". Pinning a day (or clicking the year strip) pauses the tail and freezes the window; back to live resumes.

The year strip shows per-day line counts split by level. Days beyond your plan's search window render locked: deeper history is not searchable on the current plan.

Getting more detail from a service​

By default only notice and above ships. On the host page's service catalog, the logs chip per service switches between lean and full: full floors that one service down to debug, which also turns on access-log shipping for web servers. It is a per service choice, so one noisy debug investigation does not open the firehose fleet-wide.

From logs to incidents​

Two built-ins watch the stream: an error-storm rule per service, and a broken-site rule that tells a failing docroot apart from scanner noise by shape. You can add your own log pattern rules in Alerting: a pattern that, seen often enough, folds into one incident instead of an alert per line.

From incidents to logs​

An incident row shows the host's log window around the moment it fired, and every incident links into the Logs module with the filter prefilled.

Switching logs off​

Three levels, all honest kill switches: a single service (the same logs chip), a whole host (Log shipping in the host's Manage card), or the entire workspace (Settings). The agent stops reading, not just sending.