Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
Hi, Im trying to understand how data gets stored once it arrives into the server. does it get written to disk first and than moved to RAM? or is it the other way around where the data first gets stored into RAM, and once the configured capacity is reached it than flushes the data to disk?
Posted by Shiko 9 months ago
Why does SEQCLI allow the same API key and token to be created more than once? Is there a way to force it to error if the keyname (title) or token already exists? example: seqcli apikey create --title carltest --token carltest12345678 results in apikey-62 carltest seqcli apikey create --title carltest --token carltest12345679 results in apikey-68 carltest seqcli apikey create --title carltest --token carltest12345679 results in apikey-69 carltest
Posted by Carl 9 months ago
Hi, I use the Seq.Syslog.Input to get and ingest syslog events from 3rd party to our log system on Seq. I was glad to see how fast and easy is its integration. However, it supports only UDP which is considered to be lossy and unreliable. How far are we from support for syslog on TCP? is it planned for the near future? regards Amitai
Posted by Amitai Shaveh 9 months ago
Hi there. I've setup Seq with my trial license and from what I can tell I have everything configured. I added my license in the UI and it says its valid. I was able to run the bind-ssl command and set the listenUris. I know it works to some degree because I'm able to access https://localhost and it complains that the cert doesn't match the URL which I would expect. I'm using an Azure VM so I've added firewall exceptions in the Azure portal and in the Windows firewall. I'm certain my firewall exceptions are ok because I did the same for ICMP traffic to see if I could ping the server and that works.
Posted by Troy Hughes 9 months ago
Hi. I'm using NLog with the Seq target and I was surprised to discover that the NLog target ignores `{"MinimumLevelAccepted":"Information"}` responses sent out by the server. It was going to be one of the most compelling features of Seq that I could dynamically control logging level of clients apps per API Key on the server side. And, according to Wireshark, the server is doing its job. However, the NLog target does not seem to take any notice of the hints being sent out by the server. Is this something that just hasn't been implemented, or is there something else I need to configure?
Posted by Tim Long 9 months ago
I upgraded Seq 4.2 to seq 2020.1. After installation and configuring seq from Administration. I am facing following Error. Seq is unavailable. Failed to initialize storage: An exception was thrown while activating seq.server.Data.Permalinks.Migrations.PermalinkExternalToEmbeddedEvents Can you please guide me how to upgrade seq. I am planning to upgrade to my critical machine, but if this is happening, I am afraid I can loose my existing logs.
Posted by Kamran Asim 10 months ago
I'm on my way to move our Seq to a new server and I'm trying to figure out which system requirements that we need, I read in the documentation that "1 GB RAM per 1.5 million retained events" is a good starting point. Where to I view how many retained events we have? Thanks in advance.
Posted by J Jansson 10 months ago
We have had a problem with seq over the last few versions and it's getting worse. Every now and then, the Seq interface stops responding and we can't access it for several minutes. Once we manage to get back in it seems that ingestion has been working fine all along. We're currently running 2020.1 on ubuntu but this problem has been with us for several months. At first we thought it was our server that was underpowered or something related to our hosting provider. But we have changed to a different provider and beefed up the server significantly. We have fiddled with memory configuration to no avail. Not really sure how to attack the problem at this point.
Posted by Kristoffer Lindvall 10 months ago
Hi, my text file is the output of Oracle Sqlloader : ... Tabella DDWH02_SM.TWRK_ANZ_RETL: caricamento riuscito di 1289 Righe. 0 Righe non caricate causa errori nei dati. 0 Righe non caricate perché nessuna clausola WHEN è riuscita. 0 Righe non caricate perché tutti i campi erano nulli. Dimensione dell'array di associazione non usata nel percorso diretto. Righe dell'array di colonne : 5000 Byte buffer di flusso: 256000 Byte buffer di lettura: 1048576 Totale dei record logici saltati: 1 Totale dei record logici letti: 1289 Totale dei record logici rifiutati: 0 Totale dei record logici scartati: 0 Totale dei buffer di flusso caricati dal thread principale SQL*Loader: 2 Totale dei buffer di flusso caricati dal thread di caricamento SQL*Loader: 7 Esecuzione iniziata il Mar Lug 14 11:30:23 2020 Esecuzione terminata il Mar Lug 14 11:30:23 2020 ... For me, the important lines are only : Totale dei record logici saltati: 1 Totale dei record logici letti: 1289 Totale dei record logici rifiutati: 0 Totale dei record logici scartati: 0 To filter only these lines, using command seqcli ingest -i mylogfile.log --invalid-data=ignore -x="Totale dei record" but the log message resulting on SEQ is empty. Please can you explain how to extract only interesting lines from a plain text log file ? Thanks
Posted by Claudio Barca 10 months ago
Hi, What I'm trying is to using hashicorp nomad to run the Seq server. The streams throws the error: Command run: seq run --name="name" --storage="D:\seq_data" [13:21:12 INF] Seq detected 12809.474048 MB of RAM [13:21:13 INF] Seq listening on ["http://localhost:5341/"] [13:21:13 FTL] Failed to start server System.IO.IOException: The handle is invalid. at System.ConsolePal.set_TreatControlCAsInput(Boolean value) at System.Console.set_TreatControlCAsInput(Boolean value) at Seq.Server.Cli.RunCommand.RunInteractive(Func`1 bootstrap, TextWriter cout) Just want to ask that does this Server command line allow for non-interactive mode?
Posted by Nicholas Tan 10 months ago
Recently I changed the listening port of seq, which lost all my previous log. I followed the steps in Seq Admin. I want to bring back the logs. Is this possible to bring back the log files to the same server, or bring back to another server. Here I want to mention that I did not install any archive app. I am totally dependent on Seq log files.
Posted by Kamran Asim 10 months ago
Dear Support, if we would dockerize Seq with a windows container, could we distribute the docker image among our developers so they can create their individual containers, under your free license? One Seq container (and thereby one running instance of Seq) would still just be used by one developer. Is this usage scenario possible without a violation of your free license? Best regards
Posted by Stephen Ahmad 10 months ago
Hi NIck, I use SEQ with SeqLog into Python environment, and running fine with settings from config file, as is: seqlog.configure_from_file('./logging-config.yml') I would enrich all messages with custom properties defined into config file, (as ApplicationName or EnvironmentNAme), **without add the property for each message**. How to ? Thank's
Posted by Claudio Barca 10 months ago
When typing in the query "@M" I am offered two options @Message and @MessageTemplate. How can I select between them using the keyboard? I Noticed that if there is only one option I can use Tab to autocomplete but I am looking for ways to work mouse free (as much as possible). Is there a keyboard shortcut cheatsheet for Seq?
Posted by Dani Avni 10 months ago
I run seq docker container using this command: docker run -d --restart unless-stopped --name seq -e ACCEPT_EULA=Y -v //d/Logs/Seq:/data -p 8081:80 datalust/seq:latest Docker container is up and running. But in logs I found this {"@t":"2020-07-03T18:34:31.1510983Z","@mt":"Seq {SeqVersion} running on OS {OSCaption}","SeqVersion":"2020.1.4235","OSCaption":"Linux 4.14.154-boot2docker #1 SMP Thu Nov 14 19:19:08 UTC 2019","SourceContext":"Seq.Server.Features.Diagnostics.EnvironmentInformationWriter"} {"@t":"2020-07-03T18:34:31.2140954Z","@mt":"Seq detected {TotalRAM} MB of RAM","TotalRAM":1037.53728,"SourceContext":"Seq.Server.Features.Diagnostics.EnvironmentInformationWriter"} {"@t":"2020-07-03T18:34:31.7707651Z","@mt":"Seq listening on {ListenUris}","ListenUris":["http://localhost/","http://localhost:5341/"]} {"@t":"2020-07-03T18:34:31.8006169Z","@mt":"Opening event store at {StreamPath}","StreamPath":"/data/Stream/stream.flare","SourceContext":"Flare.Cluster.StorageNodeCoordinator"} {"@t":"2020-07-03T18:34:31.8511073Z","@mt":"Opening metastore {MetastorePath}","MetastorePath":"/data/Documents/documents.lmdb","SourceContext":"Quince.Storage.Lmdb.LmdbDocumentStore"} {"@t":"2020-07-03T18:34:31.8713447Z","@mt":"Closing event store","SourceContext":"Flare.Cluster.StorageNodeCoordinator"} {"@t":"2020-07-03T18:34:31.8745417Z","@mt":"Uncaught exception from worker {WorkDescription} ({WorkId})","@l":"Error","@x":"Autofac.Core.DependencyResolutionException: An exception was thrown while activating Seq.Server.Web.Authentication.SeqOidcAuthenticationScheme -> Seq.Server.Features.Settings.SystemSettings -> λ:Quince.DocumentStore -> λ:Seq.Server.StorageSubsystem.\n ---> LightningDB 0: Failed to open environment at path /data/Documents/documents.lmdb\n --- End of inner exception stack trace ---\n at Autofac.Core.Resolving.InstanceLookup.Activate(IEnumerable`1 parameters, Object& decoratorTarget)\n at Autofac.Core.Resolving.InstanceLookup.<>c__DisplayClass6_0.<Execute>b__0()\n at Autofac.Core.Lifetime.LifetimeScope.GetOrCreateAndShare(Guid id, Func`1 creator)\n at Autofac.Core.Resolving.InstanceLookup.Execute()\n at Autofac.Core.Resolving.ResolveOperation.GetOrCreateInstance(ISharingLifetimeScope currentOperationScope, IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Resolving.ResolveOperation.ResolveComponent(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Resolving.ResolveOperation.Execute(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Lifetime.LifetimeScope.ResolveComponent(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Features.LazyDependencies.LazyRegistrationSource.<>c__DisplayClass5_1`1.<CreateLazyRegistration>b__1()\n at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)\n at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)\n at System.Lazy`1.CreateValue()\n at System.Lazy`1.get_Value()\n at Seq.Server.ServiceProcess.SystemServices.Start(CancellationToken& cancel)\n at Seq.Server.ServiceProcess.ServerService.<Start>b__8_0(CancellationToken cancel)\n at Flare.Workers.WorkerPool.<>c__DisplayClass6_0.<Run>b__0(CancellationToken ct)\n at Flare.Workers.WorkerPool.<>c__DisplayClass7_0`1.<Run>g__DoWork|0()","WorkDescription":"Start background processes","WorkId":"3507f033-2175-4170-9ee8-2ef0fa0db8c9","SourceContext":"Flare.Workers.WorkerPool"} I am using docker toolbox for running the container. Once the container started, I could see the files generated on my local system, but got stuck with this error.
Posted by annamalai 10 months ago
Hello, I have a win server 2012, without IIS installed. The web UI of SEQ is running fine at 5341 port. Using this code and this settings file I cannot write any message to log, the server response is always : requests.exceptions.HTTPError: 403 Client Error: URLBlocked for url: http://localhost:5341/api/events/raw I tried to set 127.0.0.1, or IP, or localhost, always the same issue. I have set permission to IIS_IUSR to Seq folder. Any suggest ? Thanks ----------------------------- import seqlog import logging import yaml seqlog.configure_from_file('./logging-config.yml') logger = logging.getLogger() logger.info('This is the root logger****') # Use another logger another_logger = logging.getLogger('another_logger') # Indexer-style logger.info("Hello, %s!", "World****") # Message template style logger.info("Hello, {name}!", name="World****") # Logging to another logger another_logger.info('This is another logger****') --------------------------------- logging-config.yml: # This is the Python logging schema version (currently, only the value 1 is supported here). version: 1 # Configure logging from scratch. disable_existing_loggers: True # Configure the root logger to use Seq root: class: seqlog.structured_logging.StructuredRootLogger level: INFO handlers: - seq - console loggers: # A non-root logger. another_logger: class: seqlog.structured_logging.StructuredLogger propagate: False level: INFO handlers: - seq - console handlers: # Log to STDOUT console: class: seqlog.structured_logging.ConsoleStructuredLogHandler formatter: seq # Log to Seq seq: class: seqlog.structured_logging.SeqLogHandler formatter: seq auto_flush_timeout: 3000 # milliseconds # Seq-specific settings (add any others you need, they're just kwargs for SeqLogHandler's constructor). server_url: 'http://localhost:5341/' api_key: 'my aAPI key' formatters: seq: style: '{'
Posted by Claudio Barca 10 months ago
Hi, On my Seq server - installed on a openshift (kubernetes) plateform - the RAM cache coverage is extremely low (0,083 days). The Process working set is about 7Go and the System memory utilization is less than 30%. The total plateform RAM is 48Go but Seq is configured to use maximum 40% of it (so about 29Go) (using the configuration property cache.systemRamTarget : 0.40). What can explain such a low value ?
Posted by Guilhem 10 months ago
Hi, I'm trying to manually delete events from the stream using a query (@EventType = 0x64E241FF AND Contains(message, 'xxxxxx')) but it almost everytime fails with a message 'Event deletion failed' without further explaination. Is there a way to know why deletion failed ? And How to fix this so I can delete theses events ?
Posted by Guilhem 10 months ago