Gather EVE-OS Logs From an Edge Node

Updated

Gather EVE-OS Logs From an Edge Node

Introduction

This article explains where logs live on the edge node and various ways to retrieve them: remotely with Edge View, live on the device, and as a full diagnostic bundle. These methods apply to both EVE-KVM and EVE-K, except where a step is noted as specific to the KVM hypervisor. See EVE-OS Logging Overview for more info about logs in general.

Prerequisites

Where Logs Live on the Node

Most logs are under /persist/newlog, with reboot and panic files under /persist. Use the following table to locate a specific type of log.

Path Contents
/persist/newlog/collect Temporary logs currently being written. Holds the current.device.log symlink.
/persist/newlog/devUpload Device gzip files queued for upload.
/persist/newlog/appUpload Application gzip files queued for upload.
/persist/newlog/keepSentQueue Already-uploaded logs and keep-only logs.
/persist/newlog/failedUpload Gzip files that failed upload (capped at 1000 files, roughly 50 MB).
/persist/newlog/panicStacks Pillar crash stacks (maximum 100).
/persist/log/ reboot-reason and reboot-stack, appended over time.
/persist/reboot-reason, /persist/reboot-stack Overwritten on each fatal event.

Gzip file names encode a Unix timestamp in milliseconds. Device logs use dev.log.<unixms>.gz, application logs use app.<app-uuid>.log.<unixms>.gz, and keep-only application logs carry skipTx., for example app.skipTx.<uuid>.log.<unixms>.gz.

Gather Logs Remotely With Edge View

This method works over the secure Edge View session, so you do not need SSH access or to be on the edge node's network.

Enabling and connecting Edge View (the project policy, the run-script, and the session) is covered in the Edge View articles in the prerequisites. 

This section shows only the log-specific queries you run after you already have the downloaded run-script. For the complete Edge View command set, see the LF Edge EdgeView Commands reference. 

  1. Search recent device and application logs for a term (defaults to the last 30 minutes).
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 log/<word>
  1. View logging statistics per-directory file counts and time ranges.
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 newlog
  1. View the end of the current device log directly.
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 cat/persist/newlog/collect/current.device.log -line -100
  1. Download all log files for a time window (maximum 30 minutes). The Edge View client saves them to its download directory.
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 log/copy-logfiles -time 2026-06-27T19:00:00Z-2026-06-27T19:30:00Z

Gather Logs Live on the Device

Use this method when you need a true live tail or need to explore the file system directly.

Get a shell on the device

  • Console access through keyboard, serial, or IPMI brings up the EVE-OS monitor interface, where you can open a debug shell.
  • Debug SSH requires the debug.enable.ssh configuration item set with your SSH public key, pushed from ZEDEDA Cloud.
  • From the host shell, run the eve enter debug command to open the Alpine-based debug container, which has /hostfs and /persist available and lets you install tools such as apk add jq.

Read the logs

EVE-OS writes one JSON object per log line, so after installing jq you can pipe any of the following commands through jq for readable, filterable output. The following are some of the most useful commands.

  • Live tail of everything from the in-memory buffer.
/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock
  • Live tail of the persisted device log.
tail -F /persist/newlog/collect/current.device.log
  • Read a specific device or application gzip file.
zcat /persist/newlog/devUpload/dev.log.<ts>.gz | less
  • Read the kernel ring buffer.
dmesg
  • Show only error entries from the persisted device log.
tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity=="error")'
  • Other examples of readable output:
# pretty-print every live entry
/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq .

# pull just the human-readable message text
/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq -r '.content'

# only errors, from the persisted device log
tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity=="error")'

# decompress a gzip and pretty-print it
zcat /persist/newlog/devUpload/dev.log.<ts>.gz | jq .

Filter by source tag

newlogd tags each log entry with its source (in the .source field). Some of the most useful tags to filter on include the following:

  • pillar.out / pillar.err: pillar agents (zedagent, zedrouter, domainmgr, …); these are the entries that could not be JSON-parsed.
  • wwan: cellular modem.
  • The following tags are produced by the VM/domain-management (xen-tools) path used for VM-based apps on EVE-KVM (they do not apply to EVE-K):
    • xen-tools: the domain-management container itself.
    • hypervisor: hypervisor logs.
    • guest_vm-<NAME> / guest_vm_err-<NAME>: VM console stdout / stderr.
    • qemu-dm-<NAME>: QEMU device-model output.
    • qdisk-<VM-ID>: qdisk output.

For example, to watch one application's guest console on EVE-KVM:

/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq 'select(.source | test("guest_vm-myapp"))'

Collect a Full Diagnostic Bundle

For support tickets or offline analysis, collect logs, status, network, and system information in a single .tar.gz bundle. You can start this from any one of the following:

Tune What Gets Logged

To change logging verbosity (for the device or a specific agent), the on-disk log quota, or per-application retention, see Set Log Levels to set levels per edge node or per project. See Update Edge Node Configuration Properties for all the edge node settings.

Property  Config item / setting  Notes 
Verbosity 

debug.default.loglevel  

per-agent: agent.<name>.debug.loglevel

 logrus levels: panic, fatal, error, warning, info, debug, trace 
Remote verbosity  debug.default.remote.loglevel (+ kernel/syslog variants)  Must be equal or less verbose  than the baseline, or it has no effect 
On-disk quota  newlog.gzipfiles.ondisk.maxmegabytes Default 2048 MB; capped at 10% of /persist. Recycle order: keepSentQueue → failedUpload → devUpload → appUpload 
Faster lab uploads  newlog.allow.fastupload = true 10s logfile rotation, 3s upload interval — testing only 
Keep app logs on node  AppInstanceConfig.VmConfig.disableLogs App gzips go straight to keepSentQueue (skipTx.), never uploaded 
Filter / count / dedup  log.filter.filenames, log.count.filenames, log.dedup.window.size Applied by newlogd at compression time 
Transforms (16 LTS+)  vector.config (base64 Vector config)  Preferred filtering path; Lua transform unsupported 

Verify You Have the Logs You Need

  1. Before downloading with Edge View, confirm the time range and file counts with the newlog command.
  2. After downloading with Edge View, confirm the files are present in the Edge View client's download directory.
  3. For a live tail, confirm new entries appear as events occur on the edge node.

Next Steps

Was this article helpful?
0 out of 0 found this helpful