Logs and journals

Correlate node events, resource journals, operations, and audit records.

Journals record infrastructure events and operation progress. Logs provide component output for diagnosis. Audit records identify the account and request responsible for a configuration change.

Choose a record sourceCopy link

Start with the resource journal for what happened to one object, then open the operation journal for its requested execution stages. Agent logs explain local component failures that can prevent those stages from completing.

Use the audit log to identify who requested a change. A replica-health event can arise from hardware failure without a user mutation, while an accepted audit event can precede an operation that later fails. Join them by operation or request ID rather than treating their messages as interchangeable.

These records have different access and retention policies. A journal entry is not evidence that a user directly caused the event; automated reconciliation also creates infrastructure events.

Read a journalCopy link

Open a resource's Journal tab and select a time range, severity, and component. Entries include observation time, resource ID, operation ID when available, component, and message. Use the operation ID to move between related resources.

Streaming displays newly received entries. Pausing the stream holds the visible position while the selected historical query remains available. If the source is disconnected, the last entry stays visible with its original timestamp.

Events received late can describe earlier activity. Sort by event time for an execution sequence and inspect receive time when diagnosing delayed delivery. Clock drift on a self-hosted node can distort cross-component timelines.

Host and guest logsCopy link

Node agent logs cover hypervisor, storage, networking, and agent execution. They do not automatically include arbitrary application stdout or guest system logs. Configure an application log collector inside the guest when needed.

For a self-hosted node, inspect the agent service locally:

sudo journalctl -u infra-agent --since '30 minutes ago' --no-pager

Collect the relevant operation ID, node ID, and time range before exporting logs. Do not include enrollment tokens, secret files, or private keys in support bundles.

Search and exportCopy link

Search by immutable resource ID when a display name has changed. Filtering by an operation ID includes entries from each participating component that reported that identifier. Uncorrelated component logs can require a separate time and node filter.

Exports contain the selected records and filters. Access to a project does not grant permission to export organization-wide host logs. Use role bindings to scope operational access.

Persistence and missing recordsCopy link

Retention can remove old logs while operation summaries remain. A missing log entry does not prove that an action never occurred. Check the operation record, audit event, and current resource state together.

Agents can buffer observations during disconnection within their configured local capacity. A host failure can lose undelivered output. Use remote collection and control-plane observability when durable incident records are required.