Server agent logs

The Kabeen server agent writes its activity to local log files, the first place to look when diagnosing a problem. Since version 3.2.2, those files are rotated daily with a configurable retention period: a log file growing without bound can no longer fill up the server disk.

Where the logs are

The agent writes one file per day, named after that day's date in YYYY-MM-DD.log format:

The directory is created at the agent's first start if it does not exist.

On Linux the same lines are also sent to journald, which applies its own retention policy, independent of the agent's:

sudo journalctl -u kabeen-server-agent.service -f

To read today's file:

sudo tail -f /var/log/kabeen-server-agent/$(date +%F).log

Get-Content "C:\ProgramData\Kabeen\Server Agent\logs\$(Get-Date -Format 'yyyy-MM-dd').log" -Tail 30

Before version 3.2.2, the agent wrote to a single kabeen-server-agent.log file, opened in append mode and never pruned. After the update that file is no longer written to: you can delete it manually once its contents have been archived, if needed.

Daily rotation

• The agent switches to a new file on the first event logged after midnight.
• At that same switch, it deletes the .log files in the directory that are older than the retention period.
• No scheduled task or logrotate configuration is required: the agent handles rotation itself.

Retention period

By default the agent keeps 14 days of logs. You can adjust this server by server with the log_retention_days key in the configuration file (/etc/kabeen-server-agent/config.toml on Linux, C:\ProgramData\Kabeen\Server Agent\config.toml on Windows):

api_key = "YOUR_KABEEN_API_KEY"
# Number of daily log files to keep. Default: 14.
log_retention_days = 30

Exception to hot reloading. Unlike every other config.toml key, which the agent re-reads automatically every 10 seconds, log_retention_days is read once at startup, before the logger is initialised. A change only takes effect when the service is restarted.

sudo systemctl restart kabeen-server-agent.service

Restart-Service KabeenServerAgent

Encoding. As with the API key, config.toml must be saved as UTF-8 without BOM — a UTF-16 file, or one with a BOM, prevents the agent from starting. See Diagnostics › Configuration file encoding.

Log directory access rights

Log lines can contain hostnames, service names and network flows observed on the server. On Linux the log directory is therefore restricted to its owner and group (root:root, mode 0750), so unprivileged users cannot browse it. The agent re-applies this mode at every startup.

Do not loosen these rights (chmod 755 or more permissive): the directory mode is what protects the files created by rotation.

For the other diagnostic topics (log levels, startup errors, configuration file encoding), see Diagnostics.