Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
I'm not exactly sure what have caused this problem - but our dashboards have suddently started failing - showing a big RED box saying: > An unhandled error occured while serving the request (token: 9df9097ce52b42...and > more). SEQ shows the following in the log: {"@t":"2019-03-11T14:20:19.9793140Z","@mt":"Error serving {RequestUrl} (token: {ErrorToken})","@l":"Error","@x":"Microsoft.Isam.Esent.Interop.EsentBadLogSignatureException: Bad signature for a log file\r\n at Microsoft.Isam.Esent.Interop.Api.JetInit2(JET_INSTANCE& instance, InitGrbit grbit)\r\n at Microsoft.Isam.Esent.Interop.Instance.Init(InitGrbit grbit)\r\n at Flare.Storage.Esent.Data.EsentDB..ctor(String path, String instanceName, Boolean boostWriteConcurrency)\r\n at Flare.Storage.Esent.EsentStorageExtent.BeginSession(String tag)\r\n at Flare.Storage.Esent.EsentStorageExtent.<Get>d__17.MoveNext()\r\n at Flare.Events.EventStore.<Get>d__13.MoveNext()\r\n at Flare.Queries.Executor.QueryExecutor.<ExecuteTimeSlicingPlanPart>d__17.MoveNext()\r\n at Flare.Queries.Executor.QueryExecutor.<ExecuteTimeSlicingPlan>d__16.MoveNext()\r\n at Flare.Queries.Executor.QueryExecutor.CreateTimeSlicingResult(IEventStore store, Nullable`1 rangeStartUtc, Nullable`1 rangeEndUtc, QueryExecutionState state, TimeSlicingPlan ts, QueryCache cache)\r\n at Flare.Queries.Executor.QueryExecutor.Execute(QueryPlan plan, IEventStore store, Nullable`1 rangeStartUtc, Nullable`1 rangeEndUtc, CancellationToken cancel, DateTime now, QueryCache cache)\r\n at Flare.Queries.DataStore.Query(String query, CancellationToken cancel, Nullable`1 rangeStartUtc, Nullable`1 rangeEndUtc, String filter)\r\n at Seq.Server.Web.Api.DataModule.<>c__DisplayClass5_0.<Query>g__Calculate|0(IComponentContext ctx, CancellationToken cancel)\r\n at Seq.Server.Web.Api.DataModule.<>c__DisplayClass5_1.<Query>b__1(CancellationToken ct)\r\n at Flare.Workers.WorkerPool.<>c__DisplayClass4_0.<Run>b__0()\r\n at System.Threading.Tasks.Task.Execute()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Seq.Server.Web.Api.DataModule.<Query>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Seq.Server.Web.Api.DataModule.<<-ctor>b__3_0>d.MoveNext()","RequestUrl":"https://removed.com/api/data?q=select%20count%28%2A%29%20as%20count%0D%0Afrom%20stream%20%0D%0Awhere%20%28%40Timestamp%20%3E%3D%20DateTime%28%272018-12-10T23%3A00%3A00.000Z%27%29%29%0D%0A%20%20and%20%28%40Timestamp%20%3C%20DateTime%28%272019-03-11T14%3A20%3A05.812Z%27%29%29%0D%0Agroup%20by%20time%281d%29%0D%0Alimit%2010000%0D%0A&signal=signal-135&timeoutMS=60000","ErrorToken":"b55b8261aa1a4ecba5292c145a6d303f","RequestId":"05d752a3-d355-437a-8e1d-567c33fc5567"} It seems to affect ALL dashboards - also the one that come as 'default' with SEQ. We are running SEQ 4.2
Posted by Allan Fejerskov Ravn 2 years ago
We have had a curious behaviour - which may or may not be related. let me explain. We had set up our SEQ installation and activated API keys as well as enabled User MGMT - having 3 normal users and 1 admin user. It worked - those users could login. Events with the correct API keys were received :-) Then 'suddently' one day - when I was logging into the SEQ administration - I noticed that it just said "Admin" on the top-right corner and I could not even press "logout" (the menu bullet that usually said ' logout' was gone). After some clicking around I noticed that all the API key's and users had dissappeared - it was as if I hadn't activated user MGMT and API keys at all. Now - I don't know if the following is related to my first description or not - but inside my event viewer under Application it says: seq (3464) Seq-Extent-2019-01-02T00:00:00.0000000Z: Database recovery/restore failed with unexpected error -530. and also seq (3464) Seq-Extent-2019-01-02T00:00:00.0000000Z: Unable to read the header of logfile D:\ProgramData\Seq\Extents\2019-01-02_2019-01-09\edb00002.log. Error -530. We are in the proces of upgrading from SEQ 4.2 to 5.0 - but I'd rather understand this error better before we do. Do you have an idea why this particular file fails? I can email specific logs if needed. Br. Allan
Posted by Allan Fejerskov Ravn 2 years ago
1) Once a property has been added as a column, can it be removed as a column? 2) I used "Log.ForContext<GameBase>()" and it gives the qualified path. Wondering if I can shorten this? 3) Is there an enhancer for Serilog that would add a property to an event AND put it in the message (much like popping an property to a column)? Oh... you are SEQ... but you make Serilog too... right? :) Thanks again!
Posted by Ed Landau 2 years ago
Interactively building queries Hi... I am just starting to look at Serilog and SEQ. I really like what I see but have only been at it for a few days. I have some basic questions: 1. I see if if I click on the green checkmark next to a property for an event I expanded, the filter is set to that property / data. Say the resulting set of events is still large and I want to filter it down more by selecting some other property and selecting the green tick? Is there a way to "AND" this new filter rather than resetting the filter? I could make a signal but that's a few extra steps for a signal I will likely not use again. 2. I saw in on of the discussion topics mention of using CSS in the Setting > themes (now Settings > Instance > Style Overrides). Do you have documentation on this? I would love to learn more... leading to the next question. 3. This is a stretch question but it can't hurt to ask: Is there any way to highlight an event with color (text or background or dot of whatever) based on a regular expression search of the message or some property? Thanks again for a great looking tool. One last suggestion... since I'm a single user using the free license..maybe a PayPal donation button :) -Ed
Posted by Ed Landau 2 years ago
Is it possible to write to an s3 bucket for long term storage and read from that s3 bucket instead of having the data on a machine? I think this would be a great scaleable solution if possible. I love your product but it is really lacking when it comes to long term storage solutions. Any recommendations?
Posted by Shawn Stout 2 years ago
Hello - our SEQ instance runs in Domain A, but authenticates users via LDAP via Domain B Domain Controllers. When trying to change the SEQ service to use a Domain B service account, which will allow the LDAP authentication to occur, we get an "Access Denied" error. Thinking that SEQ is preventing the changing of this. Is there a different way we should be changing the SEQ service logon account?
Posted by Logan Kampsnider 2 years ago
Hello, I'm trying out the trial version of Seq, and liking what I'm seeing so far. But I have a concern regarding long-term storage of log data. My concern is that, for now at least, management has decided not to purge logs for our mobile app. To this point log volume has not been astronomical, (10M in 2.5 years) but I expect the logging to become more verbose as I'm working on improving logging. I expect we'll tune the logging retention policy, but would still expect a large amount of events to be retained forever. I would expect this to look more like 250K events per day by the time I'm done. How does Seq handle long term storage. I know from the performance documentation page that the cache is kept in RAM and then moved to disk. If we have 250GB of data spanning 5 years, will Seq still allow us to effectively query that data? An example would be searching for a value stored as a property of the object. Thanks
Posted by David Taylor 2 years ago
I needed to delete events from our SEQ server in which the value of some key is null. When SEQ creates the message string for such an event, it display the null value as the string "null". However, if I search for that string, SEQ doesn't return such events as hits. To make this even more difficult, the custom name for the key is "Message". I will change this in our application, but I still need to delete all these events that used this as the key. What query can I use to find these events?
Posted by Tyson Williams 2 years ago
Hi. I'm having trouble deleting a user from Seq. The log says: { "@t": "2019-02-21T09:47:25.0568213Z", "@mt": "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms", "@r": [ "68.2994" ], "@l": "Error", "@x": "System.NullReferenceException: Object reference not set to an instance of an object.\r\n at Seq.Server.Data.Users.Deletions.OwnedItemDeletedPolicy`1.<>c__DisplayClass5_0.<CanDelete>b__1()\r\n at Seq.Server.Web.EntityResourceController`2.RemoveEntity(String id)\r\n at lambda_method(Closure , Object , Object[] )\r\n at Microsoft.AspNetCore.Mvc.Internal.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)\r\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeActionMethodAsync()\r\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeNextActionFilterAsync()\r\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Rethrow(ActionExecutedContext context)\r\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeInnerFilterAsync()\r\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter()\r\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)\r\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()\r\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()\r\n at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)\r\n at Seq.Server.Web.Middleware.WebSocketAcceptMiddleware.Invoke(HttpContext context)\r\n at Seq.Server.Web.Middleware.RequestAuthenticationMiddleware.Invoke(HttpContext httpContext)\r\n at Seq.Server.Web.Middleware.BrowserSecurityOptionsMiddleware.Invoke(HttpContext context)\r\n at Seq.Server.Web.Middleware.RequestCompletionMiddleware.Invoke(HttpContext httpContext)", "RequestMethod": "DELETE", "RequestPath": "/api/users/user-202", "StatusCode": 500, "Elapsed": 68.2993927999229, "ErrorToken": "0830f7b0b3e14f588ae70565a8157d91", "RequestProtocol": "HTTP/1.1", "RequestHost": "XXXXXXXXXXXXXXXXXXXXXXX", "RequestHeaders": { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" }, "SourceContext": "Seq.Server.Web.Middleware.RequestCompletionMiddleware", "RequestId": "80000c0f-0000-0700-b63f-84710c7967bb", "CorrelationId": null } The error message on the settings page: Could not save user An unhandeled error occurred while serving the request
Posted by Erling Brandvik 2 years ago
Is it possible to create a chart in a dashboard that has a filters based on the text in the message of an exception? Sometimes my application throws an exception that is caught by some top-level try/catch that creates a log event and includes the exception. If I added the exception's message to the log message, then it would be easy to filter in a chart based on that text. In the "where" text box of the chart, I could put (for example) "@Message = '%null%'" to search for exceptions with a message that said that something was null. However, I would prefer to keep the message of the log as is an access the exceptions message though the exception. Is it possible to do this?
Posted by Tyson Williams 2 years ago
Hi, We have just updated from v4.1 to v5.0, a heavily used link is now missing on the logon page for Integrated Windows Authentication. Are we missing a configuration setting to enable this or has this been removed? The actual page still exists and allows for integrated authentication. https://hostname/integrated Cheers Dave
Posted by Dave Strachan 2 years ago
Hi, Creating an internal Seq App and inside the reactor i can easily call this.Log.Information("blah") to post message back thats viewable in Seq when the app is processing. My question is there a way to configure the minimum log level, so I can have Debug level messages in the Application that will not be sent in normal operation. Cheers Dave
Posted by Dave Strachan 2 years ago
Hi, I want to track a few signals on the dashboard. I did a sql query: select @Timestamp, ConnectionWanted from stream where ConnectionWanted and SourceContext = 'Dongle:Port' The result is just a table with two columns; timestamp and a boolean value. I want to plot this on the dashboard but how do I convert a bool to an integer? Best would be for the plot to support boolean (True, False). Regards, Sebastian
Posted by Sebastian Nilsson 2 years ago
Hi Thanks again for a great product. Would it be possible to set caching response headers on the files downloaded from Seq Web UI? For example, the vendor bundle, which is 1MB is downloaded over and over each time you load the app on a new instance of your browser which is slowing down the experience for our remote users. Since the JS files look like they have unique file names for each version. Something like this should do: ``` Cache-Control: public,max-age=31536000 ```
Posted by Ray Booysen 2 years ago
Hello! We have pretty large data volume (32mln events a day) and experience problems with searching as far as it takes almost forever even if we try to find smth in a 2-3 hours interval. All events have specific custom fields which are required to be searched by. Is there an option to have indices on custom fields for faster search?
Posted by Nikolay Bobrovskiy 2 years ago