Built-in Log Files

This page is only relevant for on-premises deployments. Every component writes its own logs to the local filesystem, whether or not you have configured anything on the other pages in this group. Three families of file are produced, and each has its own rolling policy:

Family	Contains	Property prefix
Operational	The verbose `INFO`/`DEBUG` log of what the component is doing	`file.default`, `console.default`
Error	Errors only	`file.error`
Audit	The audit events the component emits, in the same JSON as a configured audit logger	`file.audit`, `console.audit`

The files are per component, under /var/log/xorlab/<stack>/<container>/ — Operation Reference lists the names, and Troubleshooting shows how to read them over SSH. They stay on the host: to get any of this off the platform, configure a channel as described in Logging Overview.

Change the defaults

Each component has a logback.properties next to its logback-audit.xml, for example activeguard/core/logback.properties and xcc/backend/logback.properties. Set only the properties you want to change; anything you leave out keeps the default below.

In the Expert Editor, open logback.properties in the component’s directory.
Add or change the property.
Click Publish. The logging configuration becomes active within about one minute.

logback.properties

# supported logback.properties with defaults
# ##############################################################
console.default.pattern=%-5level [%thread]: %logger{0} - %msg%n
console.audit.pattern=AUDIT [%versionGitDescription]: %auditLogType - %jsonMsg%n
file.default.pattern=%-5level %d{yyyy-MM-dd HH:mm:ss.SSSXXX} [%thread]: %logger{0} - %msg%n
file.audit.pattern=AUDIT %d{yyyy-MM-dd HH:mm:ss.SSSXXX} [%versionGitDescription]: %auditLogType - %jsonMsg%n
## rolling log file size policy
## 'default' corresponds to the operational events
file.default.maxFileSize=1GB
file.default.totalSizeCap=5GB
file.default.maxHistory=30
file.error.maxFileSize=1GB
file.error.totalSizeCap=5GB
file.error.maxHistory=30
file.audit.maxFileSize=1GB
file.audit.totalSizeCap=5GB
file.audit.maxHistory=30
# Override root logger level and log less events on stdout - actually logged events to stdout have log level >= max(`root.level`, `stdout.filter.level`)
stdout.filter.level=trace
# level of root appender
root.level=debug

Property	Effect
`*.pattern`	The layout of a line. The converters are the same ones as in Format Converters.
`file.*.maxFileSize`	Size at which one file rolls over.
`file.*.totalSizeCap`	Total compressed size kept for that family, across all rolled files.
`file.*.maxHistory`	Number of rolled files kept.
`root.level`	Verbosity of the root logger, and therefore the floor for everything the component logs.
`stdout.filter.level`	Verbosity on standard output only, which is what `docker compose logs` shows.

Making root.level less verbose than debug also removes the lines xorlab support needs to diagnose a problem. If you change it to save disk, put it back before you open a support case.

These properties change the built-in files only. The events you forward with a logback-audit.xml are unaffected — their format is the pattern in their own appender.

​Change the defaults

Change the defaults