Logs#
Monitoring → Logs is the router's own system journal, tailed. It is one endpoint,
GET /api/log?lines=<n>, which the agent turns into show log tail <n> on the router
and returns as an array of non-empty lines.
This is the journal. It is not the audit log and it is not the commit history, and the product keeps all three apart on purpose. The journal is what the router's daemons said; the audit log is who asked this agent to change something; the commit history is which configurations have existed.
The controls#
| Control | What it does |
|---|---|
| Live indicator | Lit while following and the last response is under 8 s old; otherwise it reads paused. |
| Filter lines… | Case-insensitive substring match, debounced by 200 ms, with a count of matching lines. |
| Line count | 50, 100, 200, 500 or 1000. The default is 200. |
| Following / Follow | Toggles the 3-second poll. |
| Refresh | One immediate fetch. |
Following auto-scrolls to the bottom whenever the filtered set changes. Turning it off stops the poll entirely rather than just stopping the scroll, so a paused log is not still costing the router a read every three seconds.
The filter runs in the browser over the lines already fetched. It does not narrow the request, so filtering for a rare string in a 200-line window will not reach further back — raise the line count instead.
Severity colouring#
Each line is coloured by the first pattern that matches it, and the patterns are plain
word matches on the line's own text — ui/src/pages/Logs.tsx:
| Colour | Matches |
|---|---|
| Red | error, err, fail, failed, critical, panic, denied |
| Amber | warn, warning |
| Muted | notice, info |
| Default | everything else |
This is a heuristic over text, not a parse of syslog priorities. A line containing the word "failed" inside a message body is coloured red whatever its actual severity, and a genuine error whose text uses none of those words is not. It is useful for scanning and should not be treated as a classification.
The line budget#
The endpoint clamps what it will return —
agent/opmode.go, handleLog:
| Input | Result |
|---|---|
| absent, unparseable, or below 1 | 100 lines |
| 1 to 5000 | that many |
| above 5000 | 5000 |
The comment on the clamp is the intent: this is a page, not a log export. For anything larger, read the journal at the console or ship it off the box.
Shipping the journal somewhere else#
Remote syslog is configuration, and it is edited on System → Settings under Remote logging. It stages, for example:
set system syslog remote 192.0.2.50 facility all level info
set system syslog remote 192.0.2.50 port 514
set system syslog remote 192.0.2.50 protocol tcpThe level list the editor offers is emerg, alert, crit, err, warning,
notice, info, debug, all. Protocol is udp (the default, and written only when
you choose otherwise) or tcp.
Reading the same thing at the console#
show log tail 200What this page will not do#
- No severity filter. The colouring is cosmetic; there is no "errors only" toggle. Type a word into the filter instead.
- No unit or facility selection. It is the whole journal as the router tails it.
- No time range. The window is "the last N lines", not "the last hour".
- No download. There is no export button. Select and copy, or use remote syslog.
- No search beyond the fetched window, as above.
See also#
- System — audit — who changed what through the agent.
- System — history — which configurations have existed.
- System — settings — the remote syslog editor.
- Diagnostics — the other place to look when something is wrong.
- One app — a container's own log, which is a separate read.
Checked against ui/src/pages/Logs.tsx,
ui/src/pages/SystemSettings.tsx,
agent/opmode.go, agent/main.go,
ui/src/lib/hooks.ts.