Logs

Available logs

• Server. Nginx error and access, auth, and PHP-FPM.
• Site. The site's Nginx error and access logs, and its application log.

A site's Logs page shows the last lines of each log, read over SSH. Follow opens the log in the console at the bottom of the app and streams new lines as they are written. To follow a server log, use Follow a log in the menu at the end of the server's toolbar, or ⌘K. Streaming runs tail -F over SSH.

How live tailing ends

A live tail holds a connection open to your server, so it stops on its own when you close it, after 5 minutes with no new output, after 30 minutes in any case, or if the log reader exits. The remote process stops with it.

If output arrives faster than the stream can deliver it, the newest lines are dropped and the stream marks the gap, so you can tell lines are missing.

Which account reads the file

Files under a site's directory are read as that site's own Unix account, so a site can read only its own logs. The system logs, Nginx, auth, and PHP-FPM, belong to root and are read as root.

Fleet search, and what a server ships

Reading and tailing work over SSH, one target at a time. To search every server at once, install the log shipper on each, under Monitoring in the server's Settings. It needs the Pro plan or above. The shipper pushes new lines every 15 seconds into an index, and the Logs page in the sidebar searches it across the fleet over up to seven days. Shipped lines are kept for 7 days on Pro and 30 days on Scale.

The shipper reads only root-owned files under /var/log, never anything inside a site's directory. It starts at the end of each file, so lines written before the install are not indexed. The same page has a Live tail mode, which follows several servers at once over SSH.

You choose which files each server ships: nginx errors, PHP-FPM, auth, and nginx access. All four are on when the shipper is installed. Access logs write one line per request, so on a busy server they are most of the volume. Turning them off is the usual way to bring a noisy server back under its budget. Changing the selection reinstalls the shipper, which rotates its credential.

The daily line budget

Each monitored server may have 500,000 log lines accepted in a 24-hour window, about 350 a minute sustained, which is a busy web server. The window starts with the first line the server ships. Past the budget, Provisore refuses that server's batches until the window turns over.

Such a server reads as paused, not silent. Silent means the server has stopped talking and somebody should look at it. Paused means the server is fine and has shipped its day's worth. Search results show how many lines were refused, so you can tell when a search is missing something.

Within one cycle the files a server watches share the budget rather than filling it first come, first served, so a busy access log cannot crowd out the error log behind it.