# Logs

The host's **Logs** tab shows the logs of your server inside the TurboStack Platform. You pick a log, a time range and search words, and the newest matching lines appear with their time and a status or level. No SSH session and no log file paths are needed.

![The Logs tab showing the web server access log of the last hour|1000](../../assets/screenshots/platform/hosts/logs_tab.png)

This tab covers:

- [Opening the tab](#opening-the-tab) - how the connection to the server works
- [Choosing a log](#choosing-a-log) - which logs you can read and what each contains
- [Access and error logs](#access-and-error-logs) - the two parts of a web server log
- [Time ranges](#time-ranges) - the fixed ranges and a custom start and end
- [Searching](#searching) - how search words are matched
- [Reading the lines](#reading-the-lines) - what the badge means and how to load more
- [Log details](#log-details) - the full line and its context fields
- [Application service logs](#application-service-logs) - the logs of your own services
- [The same logs from the command line](#the-same-logs-from-the-command-line) - `tscli logs`

> [!NOTE]
> The Logs tab is available on TurboStack hosts. It does not appear on cPanel, DirectAdmin or Windows hosts.

## Opening the tab

Open a host and click **Logs** (the rightmost tab, also reachable as `#logs` in the address bar). The tab connects to your server on its own and shows **Fetching logs...** while it reads the first lines. The connection is temporary and expires after about 15 minutes. When that happens, or when the server cannot be reached, the tab shows a message and a **Try again** button.

If the message *The logs could not be fetched* remains after a retry, wait a minute and try again. If it persists, contact Hosted Power support.

## Choosing a log

The first dropdown selects the log. **Web server** is selected when the tab opens. The platform reads the current log file and its rotated copies, so a 30-day range also covers lines that were already rotated away.

| Log | What it contains |
|---|---|
| **Web server** | The access and error logs of the web server, for every application on the host. Use this for HTTP status codes, failing requests and bot traffic. PHP errors forwarded by the web server are here too. |
| **Nginx**, **Apache** | The same web server logs as **Web server**. Pick the one that matches the web server of your host. |
| **Apps** | The logs of your own [application services](../../technologies/system-services/manage-user-services.md), such as queue workers or a Node.js process. See [Application service logs](#application-service-logs). |
| **PHP** | The log of the PHP process manager: pool starts, restarts and worker limits. Errors raised by your PHP code are usually forwarded to the web server's error log, so check **Web server** first. |
| **Database** | The server logs of every database engine on the host. |
| **MySQL**, **MariaDB**, **Postgres**, **PostgreSQL** | The server log of that one engine, including its slow-query log when that is enabled. |
| **Cache**, **Redis** | The Redis server log. Both entries read the same log. |
| **Queue**, **RabbitMQ** | The RabbitMQ broker log. Both entries read the same log. |
| **Cron** | The scheduled-task log. On some systems the scheduler writes to the general system log, so other system lines can appear here too. |
| **Mail** | The mail server log: which messages were accepted, delivered or deferred. |
| **SSH** | Logins and login attempts on the server, including key and password failures. |
| **Firewall** | The firewall log, with the connections it blocked, and the system messages the firewall writes to. |
| **System** | The general system log of the operating system. |

The lines of every log show the time the server wrote them, in **server time**.

## Access and error logs

A web server keeps two logs. The **access log** has one line per request, with the HTTP method, the path and the status code. The **error log** has the problems the web server encountered while serving requests. Examples are a backend that did not answer, a blocked request, or a PHP error forwarded by the application.

With **Web server**, **Nginx** or **Apache** selected, a second dropdown picks the part you want:

- **Access & error logs** (the default) shows both, sorted by time.
- **Access logs** shows only the requests.
- **Error logs** shows only the error lines.

![The error log of the web server over the last 7 days, narrowed to lines that contain "forbidden"|1000](../../assets/screenshots/platform/hosts/logs_error-logs.png)

The other logs have one part only, so the dropdown is not shown for them.

## Time ranges

The clock button on the right shows the active range, **Last hour** when the tab opens. Click it to choose another range:

- **Last 5 minutes**, **Last hour**, **Last 6 hours**, **Last day**, **Last 7 days** or **Last 30 days**, counted back from now.
- A custom range: fill in a **Starting date** and, if you want, an **Ending date**, then click **Apply**. Both are in server time, to the minute. Without an ending date the range runs until now. The ending date must come after the starting date.

![The time-range menu with the fixed ranges and the custom start and end|1000](../../assets/screenshots/platform/hosts/logs_time-range.png)

Pick the smallest range that covers the moment you investigate. A short range loads faster, and the lines you need are not replaced by newer ones.

## Searching

Type one or more words in **Search logs**. The list reloads about a second after you stop typing. The rules:

- **Every word must appear in the line.** `git config` shows only lines that contain both `git` and `config`.
- **Put `or` between words to match either of them.** `timeout or refused` shows lines that contain one of the two.
- **The whole line is searched**, not only the text shown in the list. For a web request that includes the client address, the referrer and the browser's user agent. So a search for a path such as `/checkout`, or for a client address, works even when the list shows only the request.
- **Letter case does not matter.**
- **A status code on its own is ignored.** The number `404` by itself matches nothing extra. Type `404 errors` (or `500 errors`, `403 errors`) to filter on that HTTP status code. Several codes next to `errors` match any of them.
- **`ERROR`, `WARNING`, `CRITICAL`, `FATAL`, `EXCEPTION` and `FAILED`** match lines with that severity.
- A search is limited to 200 characters.

![A search for "git" in the web server logs of the last 7 days|1000](../../assets/screenshots/platform/hosts/logs_search.png)

When no line matches, the list shows **No log lines found for these filters.** Widen the time range or remove a word.

## Reading the lines

The newest line is at the top. Each line shows the server time, a badge and the message:

- For a request from the access log the badge is the **HTTP status code**: blue for 2xx and 3xx, amber for 4xx and red for 5xx.
- For every other line the badge is the **level**: `[INFO]`, `[WARN]` or `[ERROR]`. It is taken from the line itself. When the line names no level, it is guessed from words such as *error* or *warning*.

A multi-line entry such as a stack trace shows its first line in the list and the rest in the details.

The tab reads the **100 newest lines** of the selected log for the chosen range and filters. When older lines exist, a **Load older** button appears below the list. Each click adds 100 more, up to 3,000 lines. When the web server log is shown with both parts, each part has its own count, so the list can hold up to twice that. Use the **Refresh** button next to the time range to read the newest lines again with the same filters.

## Log details

Click a line to open **Log details**. The popup shows:

- The server time and the **file** the line was read from.
- The full message, with every line of a multi-line entry.
- A **Copy** button that copies the raw log line as it is in the file, for a ticket or a colleague.
- **Context**: the fields the platform recognized in the line. For a web request these are the client address, method, path, protocol, status, bytes sent, referrer and user agent. For a web server error they include the level, the client, the server name and the request. When a backend was involved, the upstream is listed too. For other logs they include the program and process id, when the line names them.

![The details of one access-log line with its context fields|1000](../../assets/screenshots/platform/hosts/logs_details.png)

## Application service logs

Choose **Apps** to read the logs of the services you run under your own system users: queue workers, schedulers, a Node.js or Python process and similar. These are the services described in [Manage user services](../../technologies/system-services/manage-user-services.md). Their output is read from the service journal and from the log files the service writes to.

A second dropdown lists the services found on the host. **All apps** (the default) shows every service together. Pick a service to show only its lines.

![The Apps log with the service dropdown|1000](../../assets/screenshots/platform/hosts/logs_apps.png)

When the host runs no application services, the list stays empty.

## The same logs from the command line

The Logs tab reads the server through the [TurboStack CLI](../../api/cli.md#logs). Everything you select in the tab has a `tscli logs` equivalent, which you can run over SSH with your system user and its password from the **Credentials** tab:

| In the Logs tab | On the server |
|---|---|
| Web server, Access & error logs, Last hour | `tscli logs web last hour` |
| Web server, Error logs, Last 7 days | `tscli logs web error last 7 days` |
| Search `git` in the web server logs of the last day | `tscli logs web last day find git` |
| `404 errors` in the access log of the last 6 hours | `tscli logs web access last 6 hours find 404 errors` |
| A custom range, newest 200 lines | `tscli logs web --since=2026-11-09T13:00 --until=2026-11-09T14:00 --limit=200` |
| Apps, one service | `tscli logs app <service> last hour` |

Over SSH you see the logs of your own system user. The Logs tab shows the logs of every system user on the host. A line from another account's application is therefore visible in the tab, but not on the command line of your account.

## Related

- [Hosts](index.md)
- [Health](health.md)
- [Manage user services](../../technologies/system-services/manage-user-services.md)
- [TurboStack CLI](../../api/cli.md#logs)
- [Troubleshooting](../troubleshooting.md)