Updates
This commit is contained in:
Raven Scott
@@ -18,7 +18,7 @@ For engineers (protocol, REST deep-dive, architecture), see [docs/](../docs/READ
|
||||
| [Metric Correlations](./metric-correlations.md) | Highlight → Find Correlations → filtered wall (full walkthrough) |
|
||||
| [Related metrics](./related-metrics.md) | Per-chart ⇢ related (taxonomy + Pearson) — different from Correlate |
|
||||
| [Alerts](./alerts.md) | Anomaly list, Show / Correlate actions |
|
||||
| [Logs](./logs.md) | System log search — anomalies, audit, optional journal |
|
||||
| [Logs](./logs.md) | System log stream — journal (default), anomalies, audit; Follow / search |
|
||||
| [Fleet](./fleet.md) | Multi-host roster, set active, reconnect, forget |
|
||||
| [Settings](./settings.md) | Theme, motion, spark depth, reconnect |
|
||||
| [Keyboard shortcuts](./keyboard.md) | Charts and shell shortcuts |
|
||||
@@ -31,5 +31,5 @@ For engineers (protocol, REST deep-dive, architecture), see [docs/](../docs/READ
|
||||
1. [Connect](./connect.md) an agent
|
||||
2. Skim [Overview](./overview-tab.md)
|
||||
3. Open **Charts** — [Charts guide](./charts.md)
|
||||
4. Investigate with [Metric Correlations](./metric-correlations.md) or [Related](./related-metrics.md)
|
||||
4. Investigate with [Metric Correlations](./metric-correlations.md), [Logs](./logs.md), or [Related](./related-metrics.md)
|
||||
5. Manage hosts in [Fleet](./fleet.md)
|
||||
|
||||
@@ -20,13 +20,16 @@ Typical fields:
|
||||
|
||||
Full MC workflow: [Metric Correlations](./metric-correlations.md).
|
||||
|
||||
For searchable anomaly history (plus journal / audit), use the [Logs](./logs.md) tab.
|
||||
|
||||
## Empty list
|
||||
|
||||
No events yet, or the anomaly engine has not raised anything. Confirm the agent has been collecting for a while and that health is not stuck in a failed state (Overview KPI / `GET /api/v3/health`).
|
||||
No events yet, or the anomaly engine has not raised anything. Confirm the agent has been collecting for a while and that health is not stuck in a failed state (Overview KPI / `GET /api/v3/health` on port **18888**).
|
||||
|
||||
## REST / RPC
|
||||
|
||||
- `GET /api/v3/alerts`
|
||||
- RPC `listAlerts`
|
||||
- Anomaly search also via `GET /api/v3/logs?source=anomaly` / RPC `queryLogs`
|
||||
|
||||
See [docs/REST-API.md](../docs/REST-API.md) and [docs/PROTOCOL.md](../docs/PROTOCOL.md).
|
||||
|
||||
@@ -33,4 +33,4 @@ Failed peers show in Fleet as **Failed**; use **Reconnect** or **Forget**.
|
||||
|
||||
- Viewer dials are read-only (metrics subscribe / query).
|
||||
- Invites and admin seed are secrets — treat like passwords.
|
||||
- REST binds to localhost by default; do not expose without a reverse proxy and auth.
|
||||
- REST binds to `127.0.0.1:18888` by default; do not expose without a reverse proxy and auth.
|
||||
|
||||
@@ -8,7 +8,8 @@ Shortcuts apply when the Charts (or shell) focus is not in a text field.
|
||||
| **c** | Toggle **Correlate** mode |
|
||||
| **/** | Open Charts **Filters** and focus search |
|
||||
| **Esc** | Clear Correlate results → close Filters → dismiss Related |
|
||||
| **f** | Toggle Force (wallboard live) |
|
||||
| **f** | Charts: Force · Logs: Follow |
|
||||
| **b** | Toggle Board (pins only) |
|
||||
| **r** | Logs: refresh (when Logs tab is open) |
|
||||
|
||||
Mouse / trackpad gestures for pan, zoom, and brush are documented in [Charts](./charts.md).
|
||||
Mouse / trackpad gestures for pan, zoom, and brush are documented in [Charts](./charts.md). Logs shortcuts apply only on the [Logs](./logs.md) tab.
|
||||
|
||||
+47
-24
@@ -1,50 +1,73 @@
|
||||
# Logs
|
||||
|
||||
The **Logs** tab searches recent events from the active agent: anomalies, the agent audit trail, and (optionally) the host systemd journal.
|
||||
The **Logs** tab is a searchable stream from the active agent: host **journal** (default), **anomalies**, and the agent **audit** trail.
|
||||
|
||||
## Layout
|
||||
|
||||
| Region | Role |
|
||||
|--------|------|
|
||||
| **Header** | Follow (auto-refresh) · Refresh |
|
||||
| **Sources** | Journal · Anomalies · Audit |
|
||||
| **Time** | 15m / 1h / 6h / 24h window |
|
||||
| **Search** | Message substring; journal Max priority + Unit |
|
||||
| **Stream** | Time · severity · unit · message · actions |
|
||||
|
||||
## Sources
|
||||
|
||||
| Source | Who can use it | What it shows |
|
||||
|--------|----------------|---------------|
|
||||
| **Anomalies** | Viewer+ | Threshold / z-score events (same family as Alerts) |
|
||||
| **Audit** | Admin | Mutating RPC trail from `data/audit.log` |
|
||||
| **Journal** (default) | Admin | Host `journalctl` lines (Linux; on by default) |
|
||||
| Source | Who | What |
|
||||
|--------|-----|------|
|
||||
| **Journal** (default) | Admin | Host `journalctl` (Linux; on by default) |
|
||||
| **Anomalies** | Viewer+ | Threshold / z-score events |
|
||||
| **Audit** | Admin | Mutating RPC trail (`data/audit.log`) |
|
||||
|
||||
Audit and Journal tabs are disabled for non-admin sessions (tooltip explains why).
|
||||
Non-admin sessions see Anomalies only; Journal/Audit tabs stay disabled.
|
||||
|
||||
## Search
|
||||
## Search & follow
|
||||
|
||||
1. Open **Logs**.
|
||||
2. Pick a source.
|
||||
3. Choose a time preset (15m / 1h / 6h / 24h).
|
||||
4. Type a substring in **Search message…** (live for Anomalies/Audit; press **Search** for Journal).
|
||||
5. For Journal: optional **Priority** and **Unit** (e.g. `peardata`).
|
||||
1. Open **Logs** (defaults to Journal when admin).
|
||||
2. Pick a time window.
|
||||
3. Type in search (`/` focuses the field; **Esc** clears).
|
||||
4. Journal: optional **Max priority** (and higher) and **Unit** (e.g. `peardata.service`).
|
||||
5. **Search** or wait for debounce; **Clear** resets filters.
|
||||
6. **Follow** polls every 5s; **Refresh** / **`r`** runs once. **`f`** toggles Follow.
|
||||
7. **Copy** exports visible lines; per-row Copy for a single line.
|
||||
8. Anomaly rows: **Show** / **Correlate** → Charts (same as Alerts).
|
||||
9. **Load more** appears when the agent returns a cursor (anomaly/audit).
|
||||
|
||||
Results show severity, message (monospace), time, and unit. Anomaly rows offer **Show** / **Correlate** like the Alerts tab.
|
||||
Match text is highlighted in the message column.
|
||||
|
||||
## Host journal (default on)
|
||||
## Host journal
|
||||
|
||||
The one-line / `--server` installer:
|
||||
Installer setup (default):
|
||||
|
||||
1. Adds the `peardata` user to the **`systemd-journal`** group
|
||||
2. Sets unit **`SupplementaryGroups=systemd-journal`**
|
||||
3. Writes **`PEARDATA_JOURNAL=1`** into `/opt/peardata/.env` (and the unit Environment)
|
||||
1. `peardata` ∈ **`systemd-journal`**
|
||||
2. Unit **`SupplementaryGroups=systemd-journal`**
|
||||
3. **`PEARDATA_JOURNAL=1`** in `.env` / unit Environment
|
||||
|
||||
To disable: set `PEARDATA_JOURNAL=0` in `.env` and restart. Non-Linux agents report journal as unsupported.
|
||||
Disable with `PEARDATA_JOURNAL=0`. Non-Linux agents report journal as unsupported.
|
||||
|
||||
See [CONFIGURATION](../docs/CONFIGURATION.md) and [SECURITY](../docs/SECURITY.md).
|
||||
|
||||
## Keyboard
|
||||
|
||||
| Key | Action |
|
||||
|-----|--------|
|
||||
| `/` | Focus search |
|
||||
| `Esc` | Clear search (when focused) |
|
||||
| `r` | Refresh |
|
||||
| `f` | Toggle Follow |
|
||||
|
||||
## API
|
||||
|
||||
```http
|
||||
GET /api/v3/logs?source=anomaly&q=cpu&since=<ms>&limit=100
|
||||
GET /api/v3/logs?source=journal&q=error&limit=100
|
||||
```
|
||||
|
||||
RPC: `queryLogs` with the same fields. Audit/journal over P2P require **admin**.
|
||||
Default REST bind: `http://127.0.0.1:18888`. RPC: `queryLogs`. Audit/journal require **admin** over P2P.
|
||||
|
||||
## vs Alerts
|
||||
|
||||
| | Alerts | Logs |
|
||||
|--|--------|------|
|
||||
| Focus | Live anomaly list + notifications | Searchable multi-source history |
|
||||
| Sources | Anomalies only | Anomalies + audit + journal |
|
||||
| Focus | Live anomaly feed + notifications | Searchable multi-source history |
|
||||
| Sources | Anomalies only | Journal + anomalies + audit |
|
||||
|
||||
@@ -8,7 +8,7 @@ PearData is **decentralized, P2P, real-time host monitoring** for the Pear / Hol
|
||||
|-------|------|
|
||||
| **Agent** (`peardata-server`) | Collects metrics (~1s), stores hot/warm history, scores anomalies, serves P2P RPC + local REST |
|
||||
| **Desktop** (Pear / Electron) | Connects to one or more agents, shows Overview / Charts / Alerts / Fleet / Settings |
|
||||
| **REST** (`127.0.0.1:19999`) | Agent-compatible HTTP for scripts, Grafana, Prometheus |
|
||||
| **REST** (`127.0.0.1:18888`) | Agent-compatible HTTP for scripts, Grafana, Prometheus |
|
||||
|
||||
You dial agents by **public key** (viewer) or **`pd1.` invite** / admin seed for elevated roles.
|
||||
|
||||
@@ -19,7 +19,7 @@ You dial agents by **public key** (viewer) or **`pd1.` invite** / admin seed for
|
||||
| **Overview** | Compact home: KPIs + six spark panels + optional fleet strip |
|
||||
| **Charts** | Full metrics wall — every catalog chart, shared time, investigation |
|
||||
| **Alerts** | Recent anomaly / threshold events |
|
||||
| **Logs** | Search anomalies, audit trail, optional host journal |
|
||||
| **Logs** | Host journal (default), anomalies, and audit trail with search / Follow |
|
||||
| **Fleet** | Saved + live agents; set active, reconnect, open Charts |
|
||||
| **Connect** | Dial a new key or invite |
|
||||
| **Settings** | Theme, notifications, history depth, reconnect |
|
||||
|
||||
@@ -33,13 +33,15 @@ Without highlight windows, the agent returns **legacy alert weights** (`method=a
|
||||
|
||||
```bash
|
||||
# Highlight last 60s; baseline auto (≈4× preceding)
|
||||
curl -sG 'http://127.0.0.1:19999/api/v3/weights' \
|
||||
curl -sG 'http://127.0.0.1:18888/api/v3/weights' \
|
||||
--data-urlencode 'method=volume' \
|
||||
--data-urlencode 'after=-60' \
|
||||
--data-urlencode 'before=0' \
|
||||
--data-urlencode 'limit=30'
|
||||
```
|
||||
|
||||
(Default REST port is **18888**; override with `PEARDATA_REST_PORT`.)
|
||||
|
||||
### Response shape (conceptual)
|
||||
|
||||
```json
|
||||
|
||||
Reference in New Issue
Block a user