> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/advanced/container-management/logs.md). # Logs The Logs page lets you view and search the application logs produced by the CIPP API container. Logs are read directly from the container's local log files, which are rotated by size and retained on disk, so you can investigate recent activity, warnings, or errors from within CIPP itself. Because it reads the logs of the running instance, this is a diagnostic tool. Logs can be queried in two ways, selected by the tabs at the top of the Log Query panel: a free-form **Query Editor** for writing filter expressions directly, and a **Guided Filter** for building a search from labelled fields. Each mode has its own Clear button, which resets the form and empties the results. The panel collapses automatically once a query runs so the results have room, and can be expanded again from its header. ## Log Query ### Query Editor The Query Editor lets you write a filter using a KQL-inspired pipe syntax. Clauses are separated with the `|` character and applied in order. Enter your expression in the Log Query box and select **Run Query** to execute it. The supported clauses are: | Clause | Purpose | | ---------------------------------------------- | ----------------------------------------------------- | | `where Level == "ERR"` | Match a single log level exactly. | | `where Level in ("ERR", "CRT")` | Match any of several log levels. | | `where Level != "DBG"` | Exclude a log level. | | `where Message contains "text"` | Match entries whose message contains the text. | | `where Message !contains "text"` | Exclude entries whose message contains the text. | | `where Message matches regex "err\|fail"` | Match messages against a regular expression. | | `where Timestamp > ago(1h)` | Match entries newer than a relative time (s/m/h/d/w). | | `where Timestamp between (ago(2h) .. ago(1h))` | Match entries within a time range. | | `take 500` | Limit the number of results returned. | | `sort by Timestamp desc` | Sort the results, newest first. | | `search all files` | Include rotated log files in the search. | The **Load Preset** dropdown loads a built-in example query into the editor as a starting point, which you can then run as-is or adjust. The available presets are: | Preset | What it returns | | --------------------------------- | ---------------------------------------------------------------------------- | | Recent Errors (Last 1h) | Error and critical entries from the last hour. | | Warnings & Errors (Last 24h) | Warning, error, and critical entries from the last 24 hours. | | All Logs (Last 15 min) | Every entry from the last 15 minutes. | | Startup Logs | Entries recording service startup, with heartbeat noise removed. | | Graph API Errors | Error and critical entries mentioning Graph, from the last 24 hours. | | Token / Auth Issues | Entries mentioning token or authentication problems, from the last 24 hours. | | Timeout Errors | Entries mentioning timeouts or cancelled tasks, from the last 24 hours. | | All Errors (Search All Files) | Error and critical entries across all log files, including rotated ones. | | Standards Processing | Entries relating to Standards processing, from the last 24 hours. | | Full Log (Last 1h, no heartbeats) | All entries from the last hour with heartbeat noise removed. | ### Guided Filter The Guided Filter builds a search from labelled fields without writing a query, reading the local log files directly. Set the fields you need and select **Search Logs** to run the search. | Field | Description | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | | Time Range | Restrict results to a preset window (from the last 15 minutes up to the last 24 hours), a custom range, or no time filter at all. | | Log Level | Restrict results to a single severity, or all levels. | | Search Text | Only include lines containing this text. | | Max Lines | The maximum number of matching lines to return. Defaults to 500. | | Exclude Text | Omit any lines containing this text. | | Regex Pattern | Only include lines matching this regular expression. | | Newest First | Sort the results with the most recent entries at the top. | | From (UTC) / To (UTC) | Shown only when Time Range is set to Custom Range. The start and end of the custom window, entered in UTC. | | Log File | Choose which log file to search: the current log, or a specific rotated file (rotated files show their size). | | Search All Files (including rotated) | Search across every log file rather than a single one. When enabled, the individual Log File selection is ignored. | ## Table Details Results are shown in a table with the following columns. Selecting a row opens a details flyout showing the entry's full message and, where it differs, the raw log line it was parsed from. | Column | Description | | --------- | -------------------------------------------- | | Timestamp | The date and time the log entry was written. | | Level | The severity of the log entry. | | Message | The log message text. | Log entries are categorised by severity level: | Level | Code | | ----------- | ---- | | Debug | DBG | | Information | INF | | Warning | WRN | | Error | ERR | | Critical | CRT | *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/cipp/advanced/container-management/logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.