Logs#

Observe → Logs tails the router's own system journal. GET /api/log?lines=<n> runs show log tail <n> on the router and returns the non-empty lines.

This is the journal. It is not the audit log and it is not the commit history. The journal is what the router's daemons said; the audit log is who asked this agent to change something; the commit history is which configurations have existed.

The controls#

Control	What it does
Live indicator	Lit while following and the last response is under 8 s old; otherwise it reads paused.
Filter lines…	Case-insensitive substring match, with a count of matching lines.
Line count	`50`, `100`, `200`, `500` or `1000`. The default is 200.
Following / Follow	Toggles the poll.
Refresh	One immediate fetch.

Following auto-scrolls to the bottom whenever the filtered set changes. Turning it off stops the poll, not only the scroll.

The filter runs in the browser over the lines already fetched. It does not narrow the request, so filtering for a rare string in a 200-line window will not reach further back. Raise the line count instead.

Severity colouring#

Each line is coloured by the first pattern that matches its text:

Colour	Matches
Red	`error`, `err`, `fail`, `failed`, `critical`, `panic`, `denied`
Amber	`warn`, `warning`
Muted	`notice`, `info`
Default	everything else

This is a match on words, not a parse of syslog priorities. A line containing "failed" inside a message body is red whatever its actual severity, and an error whose text uses none of those words is not. Use it to scan, not to classify.

The line budget#

The endpoint clamps what it will return:

`lines`	Result
absent, unparseable, or below 1	100 lines
1 to 5000	that many
above 5000	5000

For a larger window, read the journal at the console or ship it off the box.

Shipping the journal somewhere else#

Remote log servers are router configuration, set on the Settings tab of the System page under Remote logging: Add log server takes the Server, the Port (514 by default), the Protocol (UDP by default, or TCP) and the Minimum severity, from Emergency to Debug, or All messages. The server receives the journal's messages at that severity and above, once the change is applied from the Commit Bar.

What this page will not do#

No severity filter. The colouring is cosmetic; there is no "errors only" toggle. Type a word into the filter instead.
No unit or facility selection. It is the whole journal as the router tails it.
No time range. The window is "the last N lines", not "the last hour".
No download. Select and copy, or use remote syslog.
No search beyond the fetched window, as above.