Logging on Zerops

Zerops captures stdout/stderr as logs; use syslog output format for severity filtering. Supports forwarding to Better Stack, Papertrail, or self-hosted ELK via syslog.

Log Types

1. Build logs — output from build pipeline
2. Prepare runtime logs — output from custom runtime image creation
3. Runtime/Database logs — operational output (stdout/stderr)

Access Methods

CLI

zcli service log -S <service-id>                     # Runtime logs (select via -S/--service-id, NOT a positional name)
zcli service log -S <service-id> --show-build-logs   # Build logs

Agents in this ecosystem read runtime logs via the zerops_logs MCP tool — it fetches runtime logs only (no build-log flag); build logs surface by auto-attachment on a deploy-failure response.

Severity Filtering

Logs must output to syslog format for severity filtering to work. Plain stdout/stderr logs appear as "info" level.

Log Forwarding

Ready-Made Integrations

• Better Stack — cloud log management
• Papertrail — cloud log aggregation
• ELK Stack — self-hosted (Elasticsearch + Logstash + Kibana)

ELK Stack Setup (Self-Hosted on Zerops)

Services needed:

• elkstorage — Elasticsearch
• kibana — UI
• logstash — Log collection (UDP syslog)

Multi-project forwarding: make Logstash public with firewall whitelist rules.

Custom syslog-ng Configuration

Critical: Use source name s_src (not s_sys):

source s_src {
    system();
    internal();
};

Certificate paths:

• System certs: /etc/ssl/certs
• Custom certs: ca-file("/etc/syslog-ng/user.crt")

Gotchas

1. UDP for Logstash: Zerops forwards logs via UDP syslog — ensure Logstash listens on UDP