Skip to content

Logs

Vesana collects logs through the agent — files, journald and the Windows Event Log — and shows them on the host. Log collection is included in every edition, also without a license key.

Not to be confused

This page covers the logs of your devices. What Vesana records about itself (connections, notifications, status changes …) is in the Global Log.

Architecture

flowchart LR
    F[File logs] --> AT[Agent]
    J[journald] --> AT
    W[Windows Event Log] --> AT
    AT --> Q[Local queue]
    Q -->|HTTPS, zstd-compressed| R[Receiver]
    R --> DB[(Log database)]
    DB --> S[Search on the host]
    DB --> SSE[Live view]

Prerequisites

  • Agent installed — logs are collected only by the agent, collectors deliver no logs. The Logs tab therefore exists only on hosts with an agent.
  • At least one log source on the host.

Adding a log source

Host detail → Logs. Without a source it says "Log collection is not active" with the buttons Activate Journald and Activate Event Log; More options offers presets and the other kinds:

  • Add Journald (all units or selected units)
  • Add file source
  • Add Event Log source (selected channels)

Under Log Sources each source can be edited ("Edit source"), disabled/enabled or deleted. The agent picks up changes with its next configuration and starts reading.

Kind Fields
File File path, service name (optional), multiline pattern (optional — lines that belong to one entry, e.g. stack traces)
journald Units (empty = all), minimum level
Windows Event Log Channels, minimum level, provider (optional), event IDs (include only / exclude)

File

Wildcards (*, ?, […]) are allowed in the file name: /var/log/myapp/*.log. The agent reads every matching file separately (at most 64, newest first) and picks up new files within about 10 seconds. Wildcards are not allowed in the directory part — /var/log/*/error.log is rejected on save. Rotated files are detected automatically; if a file is renamed to a name that also matches the pattern, the agent continues there instead of reading it again. If a file is shrunk (truncated), the agent reads it from the start.

journald

Minimum level: critical, error, warning, notice, info or all. New sources start at warning — on Linux almost every service writes info lines constantly that nobody evaluates. Two exceptions always apply, regardless of the level:

  • Login and security events (sshd, sudo, su, login, systemd-logind, user and group changes) are sent even at info — a failed login shows up there.
  • Vesana's own services (agent, collector) are not sent unless the source names the unit explicitly. Their messages are in the agent's own log or in the Global Log.

A source without a level (created before this rule) keeps collecting all levels; the level can be changed under "Edit source".

Windows Event Log

Minimum level: critical, error or warning (default warning; the interface deliberately does not offer Information — Windows writes thousands of routine events per hour). Channel names are names, not paths (\, :, .. are rejected); channels with a slash such as Microsoft-Windows-TaskScheduler/Operational are allowed. The agent reads without gaps, even when many events arrive in a short time.

Search and live view

Search on the host in the Logs tab:

  • Full text (word search, matches are highlighted)
  • Severity (multiple selection)
  • Source (Journald / File / Event Log)
  • Service
  • Time range: 15 min, 1 h, 6 h, 24 h (default) or 7 days

Entries can be expanded to show all fields. Paging works with "Load more" (100 per step).

The Live button shows new entries as they arrive (at most the last 500).

Logs also appear in the dashboard widget Log Stream.

Jump from an event log check

Event log / journald checks offer a link in the error overview and on the check into the host's Logs tab — pre-filled with exactly the filters and time window of the check ("Filters taken from the check"). If filters of the check cannot be mapped here (exclusions, regex, event IDs, multiple units), a notice says that the list is broader. If no logs are collected for the host yet, the link reads "Enable logs"; after enabling, the agent backfills the last 24 hours.

Retention

Data Default Configurable under
Log entries (full text) 30 days Admin → System → Resources → Storage
Daily counts per day, device, source and level unlimited —

Older log sections are stored compressed and remain searchable.

The daily counts are maintained by the database itself; they are kept even after the full text has expired — so "when did this start?" can be answered years later without keeping the logs longer. Available via GET /api/v1/logs/daily-counts; there is no view for it in the interface yet.

Local queue

The agent buffers log batches locally (up to 500 MB) while the server is unreachable and sends them once it is back. When the queue is full, new batches are dropped until there is room again. When the service stops, anything that could not be sent also ends up there.

Path: /var/lib/vesana-agent/log-queue/ (Linux) or C:\ProgramData\Vesana\Agent\log-queue\ (Windows).

When it is not enough

  • Very high volumes — run a dedicated solution such as Loki/Grafana alongside, send only what matters to Vesana
  • Structured telemetry (OpenTelemetry logs) — not available in Vesana
  • Compliance storage (tamper-proof) — Vesana is not WORM storage