# View app and deploy logs: live, search, download

View your app's logs live in the dashboard or with ox logs: filter by severity and process, search with a regex, pick a time range, and download them.

To view your app's logs, open the project's **Logs** tab in the dashboard, or run `ox logs <project> --follow` in a terminal. The logs are the lines your app, its workers and its cron jobs print. You can watch them live, filter and search them, look at a time range, and download them. The tab opens the log explorer, with a chart and a query bar; the **Classic view** button in its toolbar switches to the plain pane that the sections below call the classic view, and **Explorer** switches back. Both keep the process you picked. The time range comes along when Live is off; with Live on, the other view opens live too. Each deploy also has a log of its own, with the build output.

The log explorer over the last hour: one bar a minute, colored by level, and a maroon band where errors spiked. The query keeps the web process and hides health checks. The open line's **Lines around** brings back the 10 lines before and after it, from the same process.

## Read live logs and follow new lines

In the dashboard, open the project and pick the **Logs** tab. The explorer has **Live** on, so new lines appear on top as they arrive. The classic view shows the last 300 lines and checks for new ones every 5 seconds. In it, keep **Follow** ticked to stay on the newest line. Scroll up and Follow turns off, so the page stops jumping while you read.

From a terminal:

Watch the logs:

```sh
ox logs shop --follow
```

Without `--follow`, `ox logs` prints the last 100 lines and stops. Change that with `-n`; the [CLI reference](https://console.t76.sorv.dev/docs/cli#deploys-and-runs) lists every `ox logs` flag. Secret values show as `[redacted]`; [Variables](https://console.t76.sorv.dev/docs/operate/variables#redacted) lists what ox hides.

## Filter by severity and search the logs

The classic view has a bar above the lines with these filters (the explorer has its query bar, described next):

- **All**, **Errors** and **Warnings** show lines of that severity and worse.
- **All processes** is a menu: pick one process, such as the app or one worker.
- **Search the logs** finds lines with that text. Case does not matter.
- **.*** turns the search into a regular expression. Case matters, unless it starts with `(?i)`.

The same filters from a terminal:

```sh
ox logs shop --severity error
ox logs shop --process web --grep "timeout"
ox logs shop --regex "status=5[0-9][0-9]"
```

`--severity` takes `error`, `warn`, `info`, `debug` or `unknown`, a line that says nothing of its level. You can use `--grep` or `--regex`, not both.

### Explore lots of lines with a chart

The Logs tab opens the log explorer. A chart shows how many lines of each level arrived over the last 15 minutes, hour, day or week, and marks a burst of errors with a maroon band. Click a bar, or drag across bars, to look at just that time. The table under it holds up to 100,000 lines, newest first, and **Live** puts new ones on top.

Type a query in the bar, and press `/` to jump to it from anywhere on the page. Every word must match. `level:error`, `unit:web` and `user_id:42` (a field of a JSON or `key=value` line) narrow the lines, `"two words"` matches a phrase, and a `-` in front of any of these hides what it matches, as in `-healthcheck`. Click a line to see its fields. From there **Copy for AI** copies the line with the 10 lines around it and what project, process and release it came from, ready to paste into a chat with an AI assistant.

The same query from a terminal:

```sh
ox logs shop --since 1h --query 'level:error -healthcheck'
```

### See the lines around a match

A filter hides the lines next to an error, and those often say why it happened. When a filter or search is on, a matching line shows two buttons: **↑10** brings back the 10 lines just above it, and **↓10** the 10 lines just below. In the live view you can also click the line, or press Enter on it, to open both sides.

The lines that come back have every severity and no search filter, from the same process the page shows. They look dimmer than the matching lines, and a line that is already on the screen is not shown twice. Press a button again to go 10 lines further. If no buttons show on a search, your server's agent is too old to send a line's place: update it with `ox servers update <server>`.

The terminal has no such button. Use a time range with no filter to see what came before a line.

## Look at a time range, up to 30 days back

The explorer has buttons for the last 15 minutes, hour, day and week. In the classic view, the **Time range** menu has **Live**, **Last 15 min**, **Last hour**, **Last 24 hours**, **Last 7 days** and **Custom**. Custom asks for a start and an end time in UTC. **Load earlier** goes further back. A range or a search turns Follow off; tick it again to go back to live.

A range from a terminal:

```sh
ox logs shop --since 2h
ox logs shop --since 2026-10-07T09:00 --until 2026-10-07T10:00
```

`--since` and `--until` take a length like `2h` or `7d`, a time like `2026-10-07T09:00` (UTC), or an RFC 3339 time.

Your server keeps logs for up to 30 days, and less when they fill their share of the disk: 500 MB, or 1 GB on a disk of 40 GB or more, for the whole server. The bottom of the page says how far back this server goes.

## Download logs as .log or ndjson

The explorer has **.log** and **.ndjson** buttons in its toolbar. In the classic view, the bottom of the Logs tab says **Download the last 24 hours** in the live view, or **Download** when a range or search is on, with two links:

- **.log**: one line per log line, as time, process and text.
- **.ndjson**: one JSON object per line, with `time`, `process`, `unit`, `severity` and `text`.

A download takes your range and filters and stops at 100 MB. From a terminal, `-o` saves the same thing to a new file, and `--json` makes it ndjson:

Save logs to a file:

```sh
ox logs shop --since 7d --severity error -o errors.log
```

It prints `Saved errors.log` with the size. It never writes over a file that already exists.

## Read the log of one deploy or build

A deploy, rollback, backup or restore has a log of its own. Open it from **Runs** on the **Deployments** tab, or list the runs and print one:

One run's log:

```sh
ox runs shop
ox logs shop --run <id>
```

Add `--follow` to a run that is still going to print its new lines until it ends; the command exits with the run's result.

A one-off command ([`ox exec`](https://console.t76.sorv.dev/docs/cli#deploys-and-runs)) is a run too: the list shows it as **Command**, with what was typed and its exit code. Its output is your app's own data, so only a full access token or the console shows it; a read only or deploy only token gets the run without its output.

When a run fails, its page opens with a card that says what failed in plain words, why, and how to fix it, with the last lines of output and a **Deploy again** button. If the project was live and the failure left its running version in place (a failed build, or a new version that did not start and was switched back), the card also says the site is still up; after a failed switch, or on a stopped project, it claims nothing. The full log follows, ending with the step, the cause and the fix. [Troubleshooting](https://console.t76.sorv.dev/docs/troubleshooting) explains each message.

## If the logs show nothing

- **No lines at all:** the app may not be running. Check `ox status shop`, then the last run's log. If it keeps restarting, see [The app keeps crashing](https://console.t76.sorv.dev/docs/troubleshooting#crash-loop).
- **A download ends with** `ox: the download stopped at the 100 MB limit; narrow the time range or the filters for the rest`: pick a shorter range or add a filter.
- **Older lines are gone:** they are past the 30 days or the size limit above, and ox cannot get them back.

Last updated 2026-10-15. The page as HTML: https://console.t76.sorv.dev/docs/operate/logs