These docs are for Cribl Stream 4.3 and are no longer actively maintained.

See the latest version (4.13).

Internal Logs

Distributed deployments emit a larger set of logs than single-instance deployments. We’ll describe the distributed set first.

You can display and export all internal logs from the UI at Monitoring > Logs (Stream) or Manage > Logs (Edge). Logs’ persistence depends on event volume, not time – for details, see Log Rotation and Retention.

Several logs listed on this page are exposed only in customer-managed (on-prem) deployments. In Cribl.Cloud, Leaders support Cribl Stream Worker Node logs on hybrid Workers.

However, Organization Members who have the Admin Permission on Cribl Search can use that product to search the cribl_internal_logs Dataset for additional details about the Leader and its Cribl-managed Workers.

Leader Node Logs (Distributed)

​

The API/main process emits the following logs into the Leader Node’s $CRIBL_HOME/log/ directory.

The API/main process emits the following service logs into the Leader Node’s $CRIBL_HOME/log/service/ directory. Each service includes a cribl.log file that logs the service’s internal telemetry and an access.log file that logs which API calls the service has handled.

The Config Helper process for each Worker Group/Fleet emits the following log in $CRIBL_HOME/log/group/GROUPNAME.

Worker Node Logs (Distributed)

​

The API Process emits the following log in $CRIBL_HOME/log/.

Each Worker Process emits the following log in $CRIBL_HOME/log/worker/N/, where N is the Worker/Edge Node Process ID.

For convenience, the UI aggregates the Worker/Edge Node Process logs as follows.

In Cribl Stream, the logs listed above are currently available only on customer-managed hybrid Workers. The single-instance logs listed below are not relevant to Cribl.Cloud.

Single‑Instance Logs

​

The API/main process emits the same logs as it does for a distributed deployment, in$CRIBL_HOME/log/:

• cribl.log
• access.log
• audit.log
• notifications.log
• ui-access.log

Each Worker/Edge Node Process emits the following log in $CRIBL_HOME/log/worker/N/, where N is the Worker/Edge Node Process ID.

_raw stats Event Fields

​

Each Worker/Edge Node Process logs this information at a 1-minute frequency. So each event’s scope covers only that Worker/Edge Node Process, over a 1‑minute time span defined by the startTime and endTime fields.

Sample Event

​

{"time":"2022-11-17T16:54:05.349Z","cid":"w0","channel":"server","level":"info","message":"_raw stats","inEvents":307965,"outEvents":495848,"inBytes":52756162,"outBytes":83028013,"starttime":1668703980,"endtime":1668704040,"activeCxn":0,"openCxn":0,"closeCxn":0,"rejectCxn":0,"abortCxn":0,"pqInEvents":62000,"pqOutEvents":114591,"pqInBytes":12163896,"pqOutBytes":22481509,"pqTotalBytes":480467058,"droppedEvents":0,"tasksStarted":6,"tasksCompleted":6,"activeEP":9,"blockedEP":0,"cpuPerc":101.09,"eluPerc":97.81,"mem":{"heap":277,"heapTotal":287,"ext":46,"rss":453,"buffers":0}}

Field Descriptions

​