Differences

This shows you the differences between two versions of the page.

--- eve-kvm:eve-logs [2026/06/28 18:02] – created mc
+++ eve-kvm:eve-logs [2026/06/30 16:19] (current) – mc
@@ Line 42: / Line 42: @@
 ===== Method 1: Edge-View (remote, no shell) =====
 **Preferred.** Works over the secure session — no SSH, no being on the device
-network. Full details on [[eve-kvm:logs]]; the essentials:
+network. Full details on [[edge-view:log-gathering]]; the essentials:
 <code bash>
@@ Line 62: / Line 62: @@
 Getting a shell:
   * **Console** — keyboard / serial / IPMI brings up the EVE monitor TUI, from which you can drop to a debug shell.
   * **Debug SSH** — set the config item ''debug.enable.ssh'' with your SSH **public** key (push it from the controller); then SSH into the device's debug shell.
+  * **Debug container** — from the host/dom0 shell, ''eve enter debug'' drops you into the Alpine-based debug container (has ''/hostfs'' and ''/persist'' available). It is the most comfortable place to work, and you can install tools into it, e.g. ''apk add jq''.
-Once you have the shell:
+EVE log entries are **one JSON object per line**, so once ''jq'' is installed you can pipe any of the commands below through it for readable, filterable output.
+Once you have the shell:
 ^ Command ^ What it does ^
 | <code bash>/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock</code> | **Live tail of everything** — dumps the current memlogd ring buffer, then streams new entries (run from the pillar/debug container context) |
@@ Line 76: / Line 77: @@
 | <code bash>cat /persist/newlog/panicStacks/*</code> | Pillar crash stacks, locally |
-Useful **source tags** to grep for (set per container/domain by newlogd):
+Readable output with ''jq'' (enter the debug container ''eve enter debug'' then add jq package ''apk add jq''):
+<code bash>
+# pretty-print every live entry
+/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq .
+# pull just the human-readable message text
+/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq -r '.content'
+# only errors, from the persisted device log
+tail -F /persist/newlog/collect/current.device.log | jq 'select(.severity=="error")'
+# decompress a gzip and pretty-print it
+zcat /persist/newlog/devUpload/dev.log.<ts>.gz | jq .
+</code>
+Useful **source tags** to grep for (set per container/domain by newlogd):
   * ''pillar.out'' / ''pillar.err'' — pillar agents (zedagent, zedrouter, domainmgr, ...) that weren't JSON-parsed
   * ''wwan'', ''xen-tools'', ''hypervisor'' — modem, VM launcher, hypervisor
@@ Line 83: / Line 98: @@
   * ''qemu-dm-<NAME>'' — QEMU device-model output ; ''qdisk-<VM-ID>'' — qdisk output
+You can combine the tag filter with ''jq'', e.g. to watch only one app's guest console:
+<code bash>
+/hostfs/usr/bin/logread -F -socket /run/memlogdq.sock | jq 'select(.source | test("guest_vm-myapp"))'
+</code>
 ===== Method 3: Full Diagnostic Bundle (collect-info) =====
 For support tickets or offline analysis, grab the whole picture in one ''.tar.gz''
@@ Line 123: / Line 142: @@
   * Log levels & quotas: [[https://github.com/lf-edge/eve/blob/master/docs/CONFIG-PROPERTIES.md#log-levels|lf-edge/eve – CONFIG-PROPERTIES.md]]
   * ZEDEDA — Set Log Levels: [[https://help.zededa.com/hc/en-us/articles/34038411245339-Set-Log-Levels|help.zededa.com]]
-  * Sibling pages: [[eve-kvm:logs]] (Edge-View live logs), [[eve-kvm:edge-view]] (Edge-View full reference)
+  * Sibling pages: [[eve-kvm:eve-logs]] (Edge-View live logs), [[eve-kvm:edge-view]] (Edge-View full reference)