EVE-OS Logging Overview

​

Introduction

EVE-OS (Edge Virtualization Engine) collects logs from the operating system and from your edge applications through a single built-in pipeline, then stores them on the edge node and uploads a copy to Edge Infrastructure Services. Understanding this pipeline helps you know where to find logs, how quickly they appear, and how to control what gets recorded.

​

How It Works

Unlike a standard Linux server, an edge node running EVE-OS does not expose a /var/log directory or an interactive login. Instead, all logs move through an internal pipeline in stages.

• In the generate stage, EVE-OS agents, the kernel, and your edge applications write log messages into an in-memory buffer as they run.
• In the persist stage, EVE-OS writes those messages to disk on the edge node under /persist/newlog, then compresses them into gzip files.
• In the export stage, EVE-OS uploads the compressed files to Edge Infrastructure Services, oldest first, and moves them to a local sent queue after a successful upload. Uploaded logs are retained on disk as a circular buffer up to a quota (2 GB by default) and are recycled oldest-first only when space runs low. Because uploads are batched rather than continuous, logs typically appear in the Edge Infrastructure Services console within a few minutes. The delay can be longer if the edge node has been offline and is catching up.

EVE-OS separates logs into two streams.

• The device stream contains logs from EVE-OS itself, such as its networking and application-management agents.
• The application stream contains logs from your edge applications, with a separate set of files for each application. You can configure an individual application to keep its logs on the edge node only, in which case EVE-OS stores them locally but never uploads them.

The pipeline also protects against data loss and disk exhaustion. If an upload fails repeatedly, EVE-OS retains the affected files locally up to a limit so you can still retrieve them. EVE-OS also enforces an on-disk quota and recycles the oldest, least critical logs first when space runs low. This logging pipeline is part of core EVE-OS and works the same way on both the EVE-KVM and EVE-K variants. The main difference is in application logs, because each variant runs edge workloads through a different virtualization layer and therefore labels guest and hypervisor logs differently.

​

How EVE-OS Logs Relate to Other Logs and Integrations

The logs described in this article are the runtime logs that EVE-OS generates on the edge node. Several other surfaces in Edge Infrastructure Services display or forward log-related data, and it helps to understand how they differ.

• The log view in the Edge Infrastructure Services console is not a separate logging system. It displays the same device and application logs after EVE-OS uploads them, which is why entries appear with a short delay.
• Enterprise events and user-action records are a separate stream. They describe activity within Edge Infrastructure Services, for example configuration changes and edge node state changes, rather than the runtime output of EVE-OS and your applications.
• Integrations such as Splunk are export destinations, not additional log sources. When you configure a Splunk integration, Edge Infrastructure Services forwards the data you select (events, application logs, and/or metrics) to your Splunk instance so you can analyze it in your own tools.
• The OpenTelemetry (OTEL) export sends observability metrics, such as edge node and application health data, rather than log entries.
• Some diagnostics stay on the edge node and are never uploaded, for example the on-device monitor logs.

​

Key Benefits

• Retrieve logs remotely through Edge Infrastructure Services or EdgeView without opening an SSH session or being on the edge node’s network.
• Rely on consistent, structured logs, because EVE-OS records each entry as a single JSON object that you can search and filter.
• Keep troubleshooting data available even during connectivity problems, because EVE-OS persists and retries logs that cannot be uploaded.
• Control cost and noise by tuning log verbosity, on-disk quotas, and per-application retention from Edge Infrastructure Services.
• Use the same logging model across your fleet, because the pipeline behaves consistently on both EVE-KVM and EVE-K.

​

Next Steps