Log context
Log context is part of Vaicoa Pro and Vaicoa Team, on servers that run the Vaicoa agent.
Log context shows the warning and error lines a server wrote to journald in the last 72 hours. Use it to see what a server logged before an alert fired, without logging in to the server.
You need the agent on the server. There is nothing to configure: it sends journald lines at WARN level or higher from every unit.
Read a server’s lines
Section titled “Read a server’s lines”- Open the server’s detail screen, from the dashboard or the Resources tab. Dedicated servers have the same section on their own screen.
- Under Log context, below the charts, read the five most recent lines: the message, the unit and how long ago, with the severity as a colour.
- Tap View more for the server’s most recent lines, up to 200 at a time.
View more has a severity filter (All, Warning, Error, Critical+), a text filter and a share button. Sharing exports exactly the lines the filters show. Touch and hold a line to copy it.
A quiet server reads “No warnings in the last 72 hours”. A server without the agent has no Log context section at all.
Vaicoa keeps a server’s lines for 72 hours, at most 2,000 lines per server, and then deletes them. It is not a log platform: it keeps the lines that explain an incident, not every line forever.
All servers at once
Section titled “All servers at once”The dashboard’s Log activity (24 h) card adds up the last 24 hours across all your servers, as an hourly chart by severity with the noisiest servers named. Tap it for one list of every server’s recent lines, with the same filters and share button. You can also filter by server. Tap a line to open its server.
Add your own services
Section titled “Add your own services”Anything that logs to journald at warning priority or higher appears here, including your own services. From a shell script or a cron job:
logger -p user.warning -t backup "s3 sync retried 3 times, succeeded"systemd-cat -t myapp -p warning also works. Info-level lines are not sent.
To be told when a job fails or stops running, use job
reports instead.
SSH and sudo log lines (Vaicoa Team only)
Section titled “SSH and sudo log lines (Vaicoa Team only)”On Vaicoa Team, the agent can also collect SSH and sudo log lines. They are personal data about the people who administer your servers: who logged in to which server, from which address and when, plus sudo use and failed attempts. That is why this is off until a team admin turns it on.
- In the portal, open Log Collection. The page lists everything the agent sends.
- Tick Collect SSH and sudo log lines and save.
Each server picks this up within about a minute. The agent reads the lines
from /var/log/auth.log or /var/log/secure, if the system writes one of
them. They join the same log context as the rest, with the same 72 hours and
2,000 lines per server.
To turn it off, untick the box. Each server stops collecting at its next config check, usually within a minute, and lines that arrive after that are refused. Lines already collected are deleted on the normal 72-hour schedule.
On plans below Team, the page shows the setting but it cannot be changed. A team that moves down from Team keeps its setting, and it applies again if the team returns to Team.
Masking and rate limits
Section titled “Masking and rate limits”- Obvious secrets (passwords, tokens, keys, private-key blocks and authorization headers) are masked on your server, before a line is sent. Vaicoa masks them again when the line arrives, in case a server still runs an older configuration.
- If a server suddenly writes a very large number of lines, our servers rate-limit that server only. The screen then says that some lines were rate-limited, instead of dropping them without notice.
The per-server limits, the line length and every source the agent reads are in the Agent reference.