Edge View is the EVE-OS remote-access and troubleshooting subsystem. It lets you run device queries, search logs, and tunnel TCP services (SSH, VNC, HTTP, OPC-UA) from your laptop shell as if you were logged in locally, without opening any inbound port on the edge node.

Two pieces are involved:

• The Edge View server runs on the EVE device (EVE source: pkg/edgeview).
• The Edge View client is a docker run wrapper script you download from ZedControl and run on your laptop.

Both the device and the laptop connect outbound to a Dispatcher (an API endpoint in the ZEDEDA cloud). All session traffic is TLS-encrypted and each message is authenticated/encrypted with a per-session nonce, so even a compromised dispatcher cannot read or modify the relay traffic.

See also: logs for real-time log retrieval with Edge View.

Edge View is enabled per device from the controller. The session and its access policy are part of the device configuration; a controller-signed JWT is issued when the session is enabled, and the device verifies it. When the JWT expires, the session to the dispatcher is torn down.

Steps:

• Go to Edge Nodes, select the node, open the Remote Access tab.
• Initial state shows Inactive with no active session.
• Click Activate Session. A banner confirms: “Request to activate Edge View Session for Edge Node: <node> has been initiated.”
• The session badge moves from Activating (orange) to Activated (green). This takes a short while.
• Once Activated, the Download Script icon (down-arrow, top-right of the tab) becomes available.
• Click it to download the client script, named run.<node>.<epoch>.edgeview.sh.

The Remote Access tab also exposes:

• Policy - the Edge View Configuration (toggles + session limits, below).
• Access Application - per-app access shortcuts.
• Troubleshooting - in-browser terminal for the documented commands.
• Collect Info - server-side diagnostic bundle.

Edge View Configuration (from the Policy tab):

• Access EVE-OS - allow querying EVE-OS itself (enables Collect Info).
• Access Edge App Instances - allow access to the individual app instances.
• Allow ZEDEDA Cloud Session only - if on, disables the Docker client; only the in-cloud terminal is allowed.
• Override Access Policies - if on, edge-node-side changes take precedence over the policy.
• Maximum time allowed for session - JWT-enforced cap (default 720 hours).
• Default time allowed for session - default JWT lifetime (e.g. 5 hours).
• Maximum / Default connections allowed for session - concurrent connection cap (e.g. 3).
• Dispatcher URL - e.g. zedcloud.gmwtus.zededa.net/api/v1/edge-view.

The client is a docker run wrapper, so Docker is required on the laptop (Docker Desktop + WSL2 on Windows; native Docker on macOS/Linux).

Make it executable:

chmod +x run.TF-OL-CL250-1.1782606003.edgeview.sh

Run with no arguments to open the session and print the connect banner:

./run.TF-OL-CL250-1.1782606003.edgeview.sh
Edgeview is in multi-instance mode, use '-inst 1-3', try '-inst 1' here
xxxxxxx-HV665W34HG-inst-1 connecting to wss://zedcloud.gmwtus.zededa.net/api/v1/edge-view
connect success to websocket server
Client endpoint IP: 73.237.22.19
Device IPs: [192.168.2.30]; Endpoint IP 73.237.22.18
  UUID: f06d4baa-a5f2-4454-abce-7899fe1ec3fe
  Device: TF-OL-CL250-1, Enterprise: CSA-DEMOS-4316
  Controller: zedcloud.gmwtus.zededa.net
  EVE-OS release 17.0.0-rc2-kvm-amd64, IMGA
  Edge-View Ver: 0.8.8, JWT expires at 2026-06-28T00:20:03Z
  2026-06-27T19:24:09Z(UTC), uptime 3185 (sec) = 0 days

When the controller enables more than one connection, the session is multi-instance. Every command must carry -inst <num> in the range shown in the banner (here 1-3):

./run.TF-OL-CL250-1.1782606003.edgeview.sh -inst 1 app

In the command reference below, -inst <num> is omitted for brevity; insert it on every call when the session is multi-instance.

-h or -help prints the full query list. Per-command help is <cmd> -h:

./run.TF-OL-CL250-1.1782606003.edgeview.sh -inst 1 flow -h
flow[/<some pattern>] - display ip flow information in the kernel search pattern
  e.g. flow/sport=53 -- display all ip flow matching source port 53
       flow/10.1.0.2 -- display all ip flow matching ip address 10.1.0.2

Query group: [acl app arp connectivity flow if mdns nslookup ping route socket speed tcp tcpdump trace url wireless]

• acl[/<filter>] - running + configured ACLs (iptables); filter = raw / filter / nat / mangle.
• addhost/<name>/<ip> - add a static host entry to the Edge View container's /etc/hosts (not the device).
• app[/<app-string>] - list all DomU apps, or one app in detail (bridge, IP, DHCP, VNC ID, iptables, ping check).
• arp - ARP table.
• connectivity - port config list with the current index used to reach the controller.
• flow[/<pattern>] - Linux conntrack 5-tuple table; filter by IP or sport=/dport=.
• if[/<intf>] - brief interface info plus proxy config.
• mdns[/<intf>][/<service>] - zeroconf/mDNS discovery (default service workstation).
• nslookup/<ip-or-name> - DNS resolution from the device's on-site resolver.
• ping[/<ip-or-name>] - no arg pings 8.8.8.8 + controller from each interface; or ping a specific target.
• route - IP rule tables and routes across all UP interfaces.
• showcerts[/<url>][/<proxy:port>] - server-side TLS chain; no arg uses the controller URL from /config/server.
• socket - listening + established IPv4 sockets (5-tuple).
• speed[/<intf>] - speedtest download/upload, optionally on a named port.
• tcpdump/<intf>/[options] - packet capture; -time 1-120s (default 60s) or max 100 packets; e.g. tcpdump/eth0/'port 443' -time 10.
• trace[/<ip-or-name>] - traceroute (10-hop limit); no arg traces google + controller.
• url - per-service controller/datastore traffic stats since reboot (zedagent, zedrouter, loguploader…).
• wireless - wlan/wwan status and wpa_supplicant.conf content.
• tcp/… - TCP relay channels; see section 6.

Query group: [configitem cat cp datastore dmesg download du hw lastreboot ls model newlog pci pprof ps cipher usb tar techsupport top volume]

• configitem - active configitems, highlighting non-default values.
• cat/<path> [-line <n>] - file content from the EVE root; +n = head, -n = tail.
• cp/<path> - copy a device file to the laptop (needs the /download mount; see section 7).
• datastore - configured datastores (FQDN, type, cipher).
• dmesg - kernel ring buffer (errors red, warnings pink).
• download - active image download config/status + url stats since reboot.
• du/<path> - disk usage of a directory, e.g. du//persist/vault.
• hw - lshw output (JSON).
• lastreboot - reboot-reason.log and saved panic stacks.
• ls/<path> - file/dir listing; supports wildcards, e.g. ls//config/“device*”.
• model - hardware model (JSON).
• newlog - logging stats and zip-file directory state (devUpload, appUpload, keepSentQueue).
• pci - lspci output.
• pprof/on|off - toggle pillar pprof HTTP debug on port 6543 (forward it with tcp).
• ps/<string> - process status matching a cmdline substring.
• cipher - certs in /persist/certs, datastore cipher, TPM edge-node certs, controller cert.
• usb - lsusb output.
• tar/<path> - tar a directory (max 512 MB) to the laptop; vault/clear/cloudinit and *.key/*.key.pem excluded.
• top [-line <n>] - single-batch Linux top.
• volume - per-app volume + content-tree info.

Example - device memory snapshot:

 === System: <app> ===

 - device memory
Total = 7624 MiB
Available = 6920 MiB
Used = 463 MiB
Used Percent = 6.076
Free = 6568 MiB

Some logs never reach the controller (app logs set to “do not upload”), or the enterprise has no cloud log search. Edge View searches the on-device logs directly.

log/<search> [-time <start>-<end>] [-json] [-type <app|dev|all>] [-line <n>]

• Default range is now back to 30 minutes; default type is all.
• -time accepts hours-ago floats (0.2-2.5) or an RFC-3339 range; max span 5 hours.
• -json prints the full log entry instead of the summarised subset.
• Examples: log/panic -time 0.2-2.5 ; log/Clock -type app ; log/certificate -time 2026-06-15T23:15:29Z-2026-06-15T22:45:00Z -json.

Bulk download (no search string) - reserved word copy-logfiles, max 30-minute span:

./run.TF-OL-CL250-1.1782606003.edgeview.sh -inst 1 log/copy-logfiles

Files land in the container's /download. The client mounts laptop /tmp/download to container /download, so they appear locally under /tmp/download/logfiles-<timestamp>/ as merged, time-ordered dev.log.txt and app.<uuid>.log.txt.

The tcp command is the most powerful one. It builds a TCP relay from your laptop, through the dispatcher, into the device, and on to apps or external hosts. It works across NAT, firewalls, and proxies. Multiple channels can run at once.

tcp/ip:port[/ip:port...][/proxy[@dns-ip]]

• Local listener ports start at 9001 and increment per target.
• Single/first instance maps 9001-9005; each extra instance adds 5 to the range.
• The tcp command can be disabled per policy for apps or external hosts.

• Find the app IP with app (e.g. 10.1.0.130 and 192.168.1.100).
• Open the channel: tcp/10.1.0.130:22/192.168.1.100:22 → maps 9001→…:22 and 9002→…:22.
• In separate terminals: ssh testing@localhost -p 9001 and ssh testing@localhost -p 9002.

• Find the VNC display ID with app (e.g. IDs 4 and 5).
• Console VNC lives on Dom0 127.0.0.1:590x, so: tcp/localhost:5904/localhost:5905.
• Point VNC viewers at localhost:9001 and localhost:9002.

• Map several ports at once, e.g. fledge on 10.1.0.3: tcp/10.1.0.3:80/10.1.0.3:8081/10.1.0.3:4840.
• Then browse localhost:9001 (port 80), localhost:9002 (8081), and point an OPC-UA client at localhost:9003 (4840).

• Dom0-side services: target localhost:<port> in the tcp spec.
• Forward pillar pprof: pprof/on then tcp/localhost:6543.
• HTTPS proxy for URL browsing: tcp/proxy/localhost:5903 or tcp/proxy@10.1.2.3 to name a DNS resolver.

These three deposit files into the container /download (laptop /tmp/download):

• cp/<path> - copy a single device file to the laptop.
• tar/<path> - tar a directory (⇐512 MB; sensitive dirs and key files excluded).
• techsupport - compressed support bundle (~60s to build).
• collectinfo - runs collect-info.sh on the device and downloads the eve-info-*.tar.gz bundle (can take a few minutes); also available as the Collect Info tab in ZedControl.

For users with EVE internals knowledge. EVE microservices publish state under /run/<service>/; pub reads it back.

Services: [baseosmgr domainmgr downloader edgeview global loguploader msrv newlogd nim nodeagent tpmmgr vaultmgr volumemgr watcher zedagent zedclient zedkube zedmanager zedrouter zfsmanager]

• pub/<service> - all published data items for that service.
• pub/<service>/<substring> - one data structure, e.g. pub/domainmgr/domain for DomainMetric.
• pub/zedclient,zedrouter - comma-separates multiple services.

• The JWT is controller-signed, device-verified, and time-bounded; expiry tears down the session.
• Session traffic is TLS plus a per-session nonce; the dispatcher cannot read or alter it.
• Optional command signing: set the EVE ConfigItem edgeview.authen.publickey (newline-separated SSH public keys); every command must then be signed by a matching private key on the laptop.
• -inst is mandatory in multi-instance sessions; tcp to apps/external hosts may be blocked by policy.

• LF Edge EVE - EdgeView Commands: https://wiki.lfedge.org/display/EVE/EdgeView+Commands
• LF Edge EVE - EdgeView FAQ: https://wiki.lfedge.org/display/EVE/EdgeView+FAQ
• ZEDEDA Help Center - Configure Edge View with GUI: https://help.zededa.com/hc/en-us/articles/39482081360923-Configure-Edge-View-with-GUI
• EVE source: pkg/edgeview in https://github.com/lf-edge/eve