DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

System logs

Live allow-listed platform container and pod logs, streamed over authenticated SSE.

How-toOperatorAdministrator

Key points

  • Docker deployments read through the restricted socket proxy; Kubernetes deployments use read-only pods and pods/log RBAC.
  • Installed runners appear as runner:<runner-id> sources while the runner remains in dispatcher status.
  • A runner source is marked unavailable until the configured provider can reach the Docker host or an owned pod in the namespace the runner advertises.
  • Discovery follows registered docker_container_name, kubernetes_namespace, kubernetes_label_selector, and nopsai_platform_id metadata.
  • Removed runner registrations hide old runner logs even if their containers or pods still exist.
  • Runner source labels overlay dispatcher connection health, so a ready pod can still show dispatcher unreachable or recently reconnected.

Before you start

Access
System log access, which is an administrator capability
Provider
A Docker or Kubernetes log provider configured for the install
Source
A source ID from the source listcurl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/system/logs/sources" | jq

Steps

  1. 01

    List what can be read

    Sources are allow-listed. A container that is not a platform service is not a source, which is the point of the socket proxy.

    List sourcesbash
    curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/system/logs/sources" | jq '.[] | {id, name}'
    Expected result
    • One entry per platform service the provider exposes.
  2. 02

    Tail a source

    Tailing returns the recent buffer in one response, which is usually enough to answer "did this service start?".

    Tail recent linesbash
    curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/system/logs/sources/$SOURCE_ID/tail?limit=200"
    Verify
    • Lines come back redacted: secret values are masked before they leave the platform.
  3. 03

    Stream while reproducing

    The stream endpoint is server-sent events and replays recent lines before following live output.

    Follow a sourcebash
    curl -N -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/system/logs/sources/$SOURCE_ID/stream"
    Verify
    • New lines appear as the action you are reproducing happens.
  4. 04

    Decide which log you actually need

    System logs are platform services; run logs are what a pipeline produced. A run that never started is a system-log question.

How it works

Hybrid deployments use comma-separated providers such as docker,kubernetes. Reading logs from the opposite runtime still requires the API to have matching Kubernetes RBAC or a restricted Docker endpoint.

NOPSAI_PLATFORM_ID keeps bundled runners and generated runner installs on the same ownership boundary, which is what prevents one platform from listing another platform runner logs.

Buffer size, age, tail limits, line size, and stream counts are all bounded by configuration so a log viewer cannot exhaust the API.

Implementation evidence

  • doc/system-logs.md

    Providers, SSE replay, AAA, redaction, limits, and monitoring.

  • config/config.go

    System logs provider and limit settings.