terminalLogs

From your servers

Install the Zharp agent and it finds the logs on the server by itself — containers, services, PM2 apps, web servers and system logs — each under its own service name.

No app or API key is needed: the install command carries a token, and everything the agent collects goes to the Logs page. The same agent also sends host metrics and can forward your apps' traces — you can ignore that if you only want logs.

Install the agent

1
Get the command
In the dashboard, open Integrations & API → Zharp Agent → Add host. The command there has your token filled in; one token works on any number of servers.

Run it on the server

# Linux and macOS
curl -fsSL https://api.zharp.io/api/v1/install/agent.sh | sh -s -- --token YOUR_TOKEN

# Windows — elevated PowerShell
$env:ZHARP_API_KEY="YOUR_TOKEN"; irm https://api.zharp.io/api/v1/install/agent.ps1 | iex

On Kubernetes, install the Helm chart instead — see Kubernetes. On ECS Fargate, Cloud Run or Azure Container Apps, run it as a sidecar — see Serverless & Sidecars.

3
Open Logs
Within a minute, every service the agent found is listed on the Logs page.

What it picks up by itself

Source	Service name
Docker containers	The `zharp.service` label, else the Compose service or container name. Label a container `zharp.logs=false` to leave it out.
systemd services (Linux)	The unit name. Operating-system units are left out.
PM2 apps (Linux)	The app name, for root and every user.
nginx, Apache, IIS	Access and error logs, from their default locations.
System logs	`/var/log/syslog`, `messages` and `auth.log` — only `auth.log` and `kern.log` while the journal is read, so no line arrives twice.

The details — what is skipped, how PM2 is given access, how a restart carries on without sending lines twice — are in Agent Setup.

Add more

Anything else, by service name and path. The agent restarts with it:

# Your own app's log files, under one service name — globs work
sudo zharp-collector add logs --service checkout --path '/var/log/checkout/*.log'

# Web server logs at a non-default path
sudo zharp-collector add nginx --access-log /srv/nginx/access.log --error-log /srv/nginx/error.log

# Installed with --no-app-logs? Add containers, services or PM2 one at a time
sudo zharp-collector add docker-logs
sudo zharp-collector add journal
sudo zharp-collector add pm2

A timestamp at the start of a line (ISO 8601) is read as the time of the entry; lines without one get the time they were read. Stack traces arrive as one record. On Windows, run the commands in an elevated PowerShell without sudo.

Name, tag and filter

Give a container's logs a service, environment and version with labels (or ZHARP_* variables, or pod annotations on Kubernetes) — see Tags & parsing.
Drop or mask lines before they leave the server with rules and labels — see Log Configuration. To drop them in Zharp instead, see Drop rules.

docker-compose.yml

services:
  checkout:
    image: ghcr.io/acme/checkout:1.4.2
    labels:
      zharp.service: checkout
      zharp.env: prod
      zharp.version: "1.4.2"

description

Logs

Search, filter and live-tail what the agent sends.

Log Monitors

Open an incident when a pattern shows up.

tune

Log Configuration

Labels, multi-line records, exclude and mask rules.

code

From your code

Log from inside your app as well, with user and session.

Overview