Retrieve Logs with EdgeView, SSH, or Console

Introduction

This article explains where logs live on the edge node and various ways to retrieve them: remotely with Edge View, live on the device, and as a full diagnostic bundle. These methods apply to both EVE-KVM and EVE-K, except where a step is noted as specific to the KVM hypervisor. See EVE-OS Logging Overview for more information about logs in general.

Prerequisites

You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
You have onboarded a node. See Onboard Nodes.
To gather logs remotely, you have enabled Edge View for the edge node. See Configure Edge View with GUI, Configure Edge View with CLI, or Configure Edge View (Advanced Method).
To work live on the device via SSH, you have enabled SSH with your public key.
To work live on the device via keyboard and monitor, you have re-enabled console access after onboarding. See Manage Nodes with EVE-OS Local UI for the ZCLI commands. Serial and IPMI access do not require this step.

Where Logs Live on the Node

Most logs are under /persist/newlog, with reboot and panic files under /persist. Use the following table to locate a specific type of log.

Path	Contents
`/persist/newlog/collect`	Temporary logs currently being written. Holds the `current.device.log` symlink.
`/persist/newlog/devUpload`	Device gzip files queued for upload.
`/persist/newlog/appUpload`	Application gzip files queued for upload.
`/persist/newlog/keepSentQueue`	Already-uploaded logs and keep-only logs.
`/persist/newlog/failedUpload`	Gzip files that failed upload (capped at 1000 files, roughly 50 MB).
`/persist/newlog/panicStacks`	Pillar crash stacks (maximum 100).
`/persist/log/`	`reboot-reason` and `reboot-stack`, appended over time.
`/persist/reboot-reason`, `/persist/reboot-stack`	Overwritten on each fatal event.

Gzip file names encode a Unix timestamp in milliseconds. Device logs use dev.log.<unixms>.gz, application logs use app.<app-uuid>.log.<unixms>.gz, and keep-only application logs carry skipTx., for example app.skipTx.<uuid>.log.<unixms>.gz.

Gather Logs Remotely With Edge View

This method works over the secure Edge View session, so you do not need SSH access or to be on the edge node’s network. Enabling and connecting Edge View (the project policy, the run-script, and the session) is covered in the Edge View articles listed in the prerequisites. This section shows only the log-specific queries you run after you already have the downloaded run-script. For the complete Edge View command set, see the LF Edge EdgeView Commands reference.

Search recent device and application logs for a term (defaults to the last 30 minutes).
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 log/<word>
View logging statistics per-directory: file counts and time ranges.
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 newlog

View the end of the current device log directly.

./run.<edge-node>.<session-id>.edgeview.sh -inst 1 cat/persist/newlog/collect/current.device.log -line -100

Download all log files for a time window (maximum 30 minutes). The Edge View client saves them to its download directory.
./run.<edge-node>.<session-id>.edgeview.sh -inst 1 log/copy-logfiles -time 2026-06-27T19:00:00Z-2026-06-27T19:30:00Z

Gather Logs Live on the Device

Use this method when you need a true live tail or need to explore the file system directly.

Get a shell on the device

After onboarding, EVE-OS disables keyboard and VGA console access by default. To use the keyboard and monitor method, see Manage Nodes with EVE-OS Local UI for more detail on re-enabling local access Serial and IPMI access are hardware-level and are not affected by these flags.

Console access through keyboard, serial, or IPMI brings up the EVE-OS (Edge Virtualization Engine) monitor interface, where you can open a debug shell.
Debug SSH requires the debug.enable.ssh configuration item set with your SSH public key, pushed from Edge Infrastructure Services.
From the host shell, run the eve enter debug command to open the Alpine-based debug container, which has /hostfs and /persist available and lets you install tools such as apk add jq.

Read the logs

EVE-OS writes one JSON object per log line, so after installing jq you can pipe any of the following commands through jq for readable, filterable output. Live tail of everything from the in-memory buffer:

/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock

Live tail of the persisted device log:

tail -F /persist/newlog/collect/current.device.log

Read a specific device or application gzip file:

zcat /persist/newlog/devUpload/dev.log.<ts>.gz | less

Read the kernel ring buffer:

dmesg

Show only error entries from the persisted device log:

tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity="error")'

Filter by source tag

newlogd tags each log entry with its source in the .source field. Some of the most useful tags to filter on include the following:

pillar.out / pillar.err: pillar agents (zedagent, zedrouter, domainmgr, …); these are the entries that could not be JSON-parsed.
wwan: cellular modem.
The following tags are produced by the VM/domain-management (xen-tools) path used for VM-based apps on EVE-KVM (they do not apply to EVE-K):
- xen-tools: the domain-management container itself.
- hypervisor: hypervisor logs.
- guest_vm-<NAME> / guest_vm_err-<NAME>: VM console stdout / stderr.
- qemu-dm-<NAME>: QEMU device-model output.
- qdisk-<VM-ID>: qdisk output.

To filter for a specific application’s guest console on EVE-KVM:

/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq 'select(.source | test("guest_vm-myapp"))'

Collect a Full Diagnostic Bundle

For support tickets or offline analysis, collect logs, status, network, and system information in a single .tar.gz bundle. You can start this from any of the following:

Edge Infrastructure Services console: Open Infrastructure > Fleet > Nodes, click the node name, click More actions, and select Collect Logs. See Download a Diagnostic Bundle.
Edge View: run ./run.<edge-node>.<session-id>.edgeview.sh -inst 1 collectinfo. See Configure Edge View with GUI.
On the device: run collect-info.sh from the debug shell. See Download a Diagnostic Bundle.

Tune What Gets Logged

To change logging verbosity, the on-disk log quota, or per-application retention, see Set Log Levels.

Property	Config item / setting	Notes
Verbosity	`debug.default.loglevel`; per-agent: `agent.<name>.debug.loglevel`	Log levels: `panic`, `fatal`, `error`, `warning`, `info`, `debug`, `trace`.
Remote verbosity	`debug.default.remote.loglevel` (+ kernel/syslog variants)	Must be equal or less verbose than the baseline, or it has no effect.
On-disk quota	`newlog.gzipfiles.ondisk.maxmegabytes`	Default 2048 MB; capped at 10% of `/persist`. Recycle order: `keepSentQueue` → `failedUpload` → `devUpload` → `appUpload`.
Faster uploads	`newlog.allow.fastupload = true`	10s log file rotation, 3s upload interval. For testing only.
Keep app logs on node	`AppInstanceConfig.VmConfig.disableLogs`	App gzips go straight to `keepSentQueue` (`skipTx.`), never uploaded.
Filter / count / dedup	`log.filter.filenames`, `log.count.filenames`, `log.dedup.window.size`	Applied by `newlogd` at compression time.
Transforms (16 LTS+)	`vector.config` (base64 Vector config)	Preferred filtering path. Lua transforms are not supported.

Verify You Have the Logs You Need

Before downloading with Edge View, confirm the time range and file counts with the newlog command.
After downloading with Edge View, confirm the files are present in the Edge View client’s download directory.
For a live tail, confirm new entries appear as events occur on the edge node.

Next Steps

EVE-OS Logging Overview

Understand the logging pipeline, log streams, and on-disk storage.

Set Log Levels

Adjust logging verbosity for the device or a specific agent.

Download a Diagnostic Bundle

Gather a full diagnostic bundle from a node using the console or EdgeView.

Configure Edge View with GUI

Enable and connect Edge View for remote node access.

Start Here

Infrastructure Services Overview

Core infrastructure

Build

Applications and delivery

Edge Kubernetes

Operations

Monitor

Administration and Security

Troubleshooting

Partnerships

Retrieve Logs with EdgeView, SSH, or Console

Introduction

Prerequisites

Where Logs Live on the Node

Gather Logs Remotely With Edge View

Gather Logs Live on the Device

Get a shell on the device

Read the logs

Filter by source tag

Collect a Full Diagnostic Bundle

Tune What Gets Logged

Verify You Have the Logs You Need

Next Steps

EVE-OS Logging Overview

Set Log Levels

Download a Diagnostic Bundle

Configure Edge View with GUI

​Introduction

​Prerequisites

​Where Logs Live on the Node

​Gather Logs Remotely With Edge View

​Gather Logs Live on the Device

​Get a shell on the device

​Read the logs

​Filter by source tag

​Collect a Full Diagnostic Bundle

​Tune What Gets Logged

​Verify You Have the Logs You Need

​Next Steps

EVE-OS Logging Overview

Set Log Levels

Download a Diagnostic Bundle

Configure Edge View with GUI

Introduction

Prerequisites

Where Logs Live on the Node

Gather Logs Remotely With Edge View

Gather Logs Live on the Device

Get a shell on the device

Read the logs

Filter by source tag

Collect a Full Diagnostic Bundle

Tune What Gets Logged

Verify You Have the Logs You Need

Next Steps