Logs
This chapter covers the Logs menu: read the logs of the host and of VMs, search and follow them live, download them, produce a diagnostic bundle for the maintainers, and forward logs to another machine.
1. Reading logs
Open Logs. You need the log:read permission.
- The first drop-down chooses the source: Host · /var/log (the host's own logs), or one VM from the Virtual machines group (only VMs that have log files are listed).
- The second drop-down chooses a file of that source, with its size in brackets. The host has the system log, keel's own log and so on; for a VM it is the log keel keeps for it (boot, devices, errors). When you pick a source, its first file opens automatically.
- The page shows the end of the file. Lines can be 200, 500, 2000 or 10000. Click Older lines to page backwards.
- When you pick a VM's log, a link next to the title goes back to that VM's page.
Times in logs are UTC (the page says so), whatever time zone you have set.
Note: Before you have a storage pool,
/var/logis in memory and is gone after a reboot; the page tells you so. In that case the kernel messages of each boot and the tail of the important logs are saved to the boot partition (the last 3 boots), and moved to/var/log/boot-partition/once a pool exists. To create a pool see Storage.
2. Search and filter
The search bar is below the file picker:
- Search (text): type text and press Enter to keep only the lines that contain it; the matching text is highlighted. Tick regex to use a regular expression.
- Level: All, warnings and errors, errors only.
- From / To: show only lines from that time range.
- After filtering the page shows how many lines match. If the file is very large only the last 256 MB is searched, and the page says so.
Click a matching line and its Context appears below: 5, 20, 50 or 200 lines before and after it (lines before and after), so you can see what happened before that message. Click Close to fold it.
3. Following live
Tick Live and new log lines are appended at the bottom as they appear; the status dot shows live. Scroll up to read older lines and it changes to paused (scrolled up); scroll back to the bottom to continue. If the connection drops it reconnects automatically. Old compressed logs cannot be followed live. Refresh reads everything again.
4. Downloading
- Download: download the current file as it is.
- Download the support bundle (top right of the page, needs
log:read): produces a.tar.gzfor the maintainers or for asking for help on a forum. It holds the version, dmesg, logs, ZFS, network, PCI and settings. Passwords, tokens and keys are always removed.
Click Download the support bundle and a small window opens:
- Period: All, or Dates (Start, End, counted in whole days). Only logs with timestamps are cut to the period; material without timestamps (version, command output, settings, the kernel log of each boot, the console) is always included.
- Include: IP addresses (IPv4, IPv6), MAC addresses (the vendor's 3 bytes stay), Host name and domain, Serial numbers (disks, board) and the host UUID, E-mail addresses. What is ticked goes into the bundle as is; what is not ticked is replaced with a stand-in, and the same value gets the same stand-in everywhere in the bundle, so the maintainers can still tell it is the same machine. Everything is ticked by default; untick before you post the bundle anywhere public.
Click OK and the browser starts the download.
5. Remote syslog
At the bottom of the page (needs host write permission) is a collapsible Remote syslog. Enter another machine's address (192.168.1.10 or 192.168.1.10:514, UDP, default port 514) and click Save: the host's syslog and keel's log are then sent there as well. Leave it empty to turn it off.
6. Logs elsewhere
- A VM's log can also be reached from that VM's own page.
- Who did what and when is in System → Audit log, see Accounts, Tokens and Permissions.
- Host reboots, crash records and the host check are in System → Maintenance, see System: Maintenance, Time and Host Console.