> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Retrieve Logs with EdgeView, SSH, or Console > Retrieve EVE-OS and application logs from an edge node remotely with Edge View, live on the device, or as a full diagnostic bundle. ## Introduction This article explains where logs live on the edge node and various ways to retrieve them: remotely with Edge View, live on the device, and as a full diagnostic bundle. These methods apply to both EVE-KVM and EVE-K, except where a step is noted as specific to the KVM hypervisor. See [EVE-OS Logging Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/eve-os-logging-overview.md) for more information about logs in general. ## Prerequisites * You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md). * You have onboarded a node. See [Onboard Nodes](https://zededa.mintlify.site/new-ui/infrastructure-services/nodes/onboard-nodes.md). * To gather logs remotely, you have enabled Edge View for the edge node. See [Configure Edge View with GUI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-gui.md), [Configure Edge View with CLI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-cli.md), or [Configure Edge View (Advanced Method)](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-advanced.md). * To work live on the device via SSH, you have [enabled SSH](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/enable-disable-ssh.md) with your public key. * To work live on the device via keyboard and monitor, you have re-enabled console access after onboarding. See [Manage Nodes with EVE-OS Local UI](https://zededa.mintlify.site/new-ui/infrastructure-services/manage-nodes-with-local-ui.md) for the ZCLI commands. Serial and IPMI access do not require this step. ## Where Logs Live on the Node Most logs are under `/persist/newlog`, with reboot and panic files under `/persist`. Use the following table to locate a specific type of log. | Path | Contents | | - | - | | `/persist/newlog/collect` | Temporary logs currently being written. Holds the `current.device.log` symlink. | | `/persist/newlog/devUpload` | Device gzip files queued for upload. | | `/persist/newlog/appUpload` | Application gzip files queued for upload. | | `/persist/newlog/keepSentQueue` | Already-uploaded logs and keep-only logs. | | `/persist/newlog/failedUpload` | Gzip files that failed upload (capped at 1000 files, roughly 50 MB). | | `/persist/newlog/panicStacks` | Pillar crash stacks (maximum 100). | | `/persist/log/` | `reboot-reason` and `reboot-stack`, appended over time. | | `/persist/reboot-reason`, `/persist/reboot-stack` | Overwritten on each fatal event. | Gzip file names encode a Unix timestamp in milliseconds. Device logs use `dev.log..gz`, application logs use `app..log..gz`, and keep-only application logs carry `skipTx.`, for example `app.skipTx..log..gz`. ## Gather Logs Remotely With Edge View This method works over the secure Edge View session, so you do not need SSH access or to be on the edge node's network. Enabling and connecting Edge View (the project policy, the run-script, and the session) is covered in the Edge View articles listed in the prerequisites. This section shows only the log-specific queries you run after you already have the downloaded run-script. For the complete Edge View command set, see the [LF Edge EdgeView Commands](https://wiki.lfedge.org/display/EVE/EdgeView+Commands) reference. 1. Search recent device and application logs for a term (defaults to the last 30 minutes). ``` ./run...edgeview.sh -inst 1 log/ ``` 2. View logging statistics per-directory: file counts and time ranges. ``` ./run...edgeview.sh -inst 1 newlog ``` 3. View the end of the current device log directly. ``` ./run...edgeview.sh -inst 1 cat/persist/newlog/collect/current.device.log -line -100 ``` 4. Download all log files for a time window (maximum 30 minutes). The Edge View client saves them to its download directory. ``` ./run...edgeview.sh -inst 1 log/copy-logfiles -time 2026-06-27T19:00:00Z-2026-06-27T19:30:00Z ``` ## Gather Logs Live on the Device Use this method when you need a true live tail or need to explore the file system directly. ### Get a shell on the device > [!NOTE] > > After onboarding, EVE-OS disables keyboard and VGA console access by default. To use the keyboard and monitor method, see [Manage Nodes with EVE-OS Local UI](https://zededa.mintlify.site/new-ui/infrastructure-services/manage-nodes-with-local-ui.md) for more detail on re-enabling local access Serial and IPMI access are hardware-level and are not affected by these flags. * Console access through keyboard, serial, or IPMI brings up the EVE-OS (Edge Virtualization Engine) monitor interface, where you can open a debug shell. * Debug SSH requires the `debug.enable.ssh` configuration item set with your SSH public key, pushed from Edge Infrastructure Services. * From the host shell, run the `eve enter debug` command to open the Alpine-based debug container, which has `/hostfs` and `/persist` available and lets you install tools such as `apk add jq`. ### Read the logs EVE-OS writes one JSON object per log line, so after installing `jq` you can pipe any of the following commands through `jq` for readable, filterable output. Live tail of everything from the in-memory buffer: ``` /hostfs/usr/bin/logread -F -socket /run/memlogdq.sock ``` Live tail of the persisted device log: ``` tail -F /persist/newlog/collect/current.device.log ``` Read a specific device or application gzip file: ``` zcat /persist/newlog/devUpload/dev.log..gz | less ``` Read the kernel ring buffer: ``` dmesg ``` Show only error entries from the persisted device log: ``` tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity="error")' ``` Other examples of readable output: ``` # pretty-print every live entry /hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq . # pull just the human-readable message text /hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq -r '.content' # only errors, from the persisted device log tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity="error")' # decompress a gzip and pretty-print it zcat /persist/newlog/devUpload/dev.log..gz | jq . ``` ### Filter by source tag `newlogd` tags each log entry with its source in the `.source` field. Some of the most useful tags to filter on include the following: * `pillar.out` / `pillar.err`: pillar agents (`zedagent`, `zedrouter`, `domainmgr`, ...); these are the entries that could not be JSON-parsed. * `wwan`: cellular modem. * The following tags are produced by the VM/domain-management (`xen-tools`) path used for VM-based apps on EVE-KVM (they do not apply to EVE-K): * `xen-tools`: the domain-management container itself. * `hypervisor`: hypervisor logs. * `guest_vm-` / `guest_vm_err-`: VM console stdout / stderr. * `qemu-dm-`: QEMU device-model output. * `qdisk-`: qdisk output. To filter for a specific application's guest console on EVE-KVM: ``` /hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq 'select(.source | test("guest_vm-myapp"))' ``` ## Collect a Full Diagnostic Bundle For support tickets or offline analysis, collect logs, status, network, and system information in a single `.tar.gz` bundle. You can start this from any of the following: * **Edge Infrastructure Services console**: Open **Infrastructure > Fleet > Nodes**, click the node name, click **More actions**, and select **Collect Logs**. See [Download a Diagnostic Bundle](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/collect-diagnostic-data.md). * **Edge View**: run `./run...edgeview.sh -inst 1 collectinfo`. See [Configure Edge View with GUI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-gui.md). * **On the device**: run `collect-info.sh` from the debug shell. See [Download a Diagnostic Bundle](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/collect-diagnostic-data.md). ## Tune What Gets Logged To change logging verbosity, the on-disk log quota, or per-application retention, see [Set Log Levels](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/set-log-levels.md). | Property | Config item / setting | Notes | | - | - | - | | Verbosity | `debug.default.loglevel`; per-agent: `agent..debug.loglevel` | Log levels: `panic`, `fatal`, `error`, `warning`, `info`, `debug`, `trace`. | | Remote verbosity | `debug.default.remote.loglevel` (+ kernel/syslog variants) | Must be equal or less verbose than the baseline, or it has no effect. | | On-disk quota | `newlog.gzipfiles.ondisk.maxmegabytes` | Default 2048 MB; capped at 10% of `/persist`. Recycle order: `keepSentQueue` → `failedUpload` → `devUpload` → `appUpload`. | | Faster uploads | `newlog.allow.fastupload = true` | 10s log file rotation, 3s upload interval. For testing only. | | Keep app logs on node | `AppInstanceConfig.VmConfig.disableLogs` | App gzips go straight to `keepSentQueue` (`skipTx.`), never uploaded. | | Filter / count / dedup | `log.filter.filenames`, `log.count.filenames`, `log.dedup.window.size` | Applied by `newlogd` at compression time. | | Transforms (16 LTS+) | `vector.config` (base64 Vector config) | Preferred filtering path. Lua transforms are not supported. | ## Verify You Have the Logs You Need 1. Before downloading with Edge View, confirm the time range and file counts with the `newlog` command. 2. After downloading with Edge View, confirm the files are present in the Edge View client's download directory. 3. For a live tail, confirm new entries appear as events occur on the edge node. ## Next Steps > [card] [EVE-OS Logging Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/eve-os-logging-overview.md) > > Understand the logging pipeline, log streams, and on-disk storage. > [card] [Set Log Levels](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/set-log-levels.md) > > Adjust logging verbosity for the device or a specific agent. > [card] [Download a Diagnostic Bundle](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/collect-diagnostic-data.md) > > Gather a full diagnostic bundle from a node using the console or EdgeView. > [card] [Configure Edge View with GUI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-gui.md) > > Enable and connect Edge View for remote node access.