Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
We have been considering the Pros and Cons of using SEQ as the repository for our AuditLog. I have read a few questions in this forum (eg. [This] (https://docs.getseq.net/discuss/5818946bb1e11c1900bf76b2) and [This](https://docs.getseq.net/discuss/58401d08de0ace190064cec5) ). However I still have a few questions: **What's the difference between WriteTo and AuditTo?** Assuming that the SEQ server and the connection to the SEQ server doesn't go down - I would guess that WriteTo still maintains the same sequence of events as AuditTo? Or that this problem could be solved using a timestamp generated in the client code? As far as I have understood this - just using WriteTo and not generating the 'auditing timestamp' - but relying on the SEQ server timestamp will actually be a problem for the sequence? **Is there a difference with exceptions, when using WriteTo and AuditTo?** In one of the previous post - answers you wrote: > AuditTo has the advantage of logging synchronously and propagating any exceptions, > but of course comes with a corresponding performance cost. You could use a second > server and WriteTo if guaranteed audit logging isn't a strict requirement. Could you try and explain this in a bit more detail? **Is performance good enough?** When sending both regular 'warnings and errors' to SEQ the number should be pretty low, but including an audit trail for each user severily increases the number of events sent to SEQ. Do you have a kind of 'formula' to use when trying to estimate disc usage and other HW specs? The reason I'm asking is that it could be a requirement to keep this kind of data between 1-5 years and I'm kind of worried that disc space especially could be an issue - because the auditlog cannot be deleted and it should also still be searchable. **Could you perhaps add a seperate documentation section about using SEQ as AuditLog?** SEQ has many advantages and I'm assuming that we are not the first ones considering to use SEQ as a audit log repo - it might be worth it to keep a seperate link on the documentation page about this. Just describing those 'special concerns' that needs to be thought about when using SEQ for this fairly important log.
Posted by Allan 7 months ago
I was attempting to follow the best practice advice: *It is best practice to use an unprivileged machine account to run the Seq service. This should be a local Windows account on the target server (by default Local System is used otherwise).* So I created a local user on the SEQ target machine and switched the Windows Service to run as this new user and tried to start SEQ again - however the Windows Service only briefly started up before automatically shutting down again. For troubleshooting I then gave the same user 'Full Control' to the default installation paths of SEQ (both programData and Program Files) - but it didn't make a difference. I did this using the Windows Server GUI - so did not do anything with the SEQ cmd-line tool... Have I missed something? I guess that it shouldn't be necessary to add the same user as 'Full Control' to the SEQ folders? (and it also did not make any difference). Are there any logs I can look at for troubleshooting or do you have an idea why this scenario could happen?
Posted by Allan 8 months ago
I'm trying to use the Slack app to send events to a Slack channel. When I enable 'Stream incoming events' and the signal drop down appears, the only signals I can see are "Errors", "Exceptions" and "Warnings". I can't seem to access any of the custom signals I have created. This happens in other apps such as EmailPlus as well. I'm using Seq 5.0.2394
Posted by James Fera 8 months ago
I have the code below to configure the project to log to seq. Which was copy and pasted from the documentation. ''' import json import logging from flask import Flask from config import Config import seqlog app = Flask(__name__) app.config.from_object(Config) seqlog.log_to_seq( server_url="http://***:5341/", api_key="***", level=logging.DEBUG, batch_size=5, auto_flush_timeout=2, # seconds override_root_logger=True, json_encoder_class=json.encoder.JSONEncoder ) import views ''' When the app starts i get the following error: ''' FLASK_APP = app.py FLASK_ENV = development FLASK_DEBUG = 0 In folder /Users/kelvinmacartney/PycharmProjects/comp-2011-cwk-2 /Users/kelvinmacartney/PycharmProjects/comp-2011-cwk-2/venv/bin/python -m flask run * Serving Flask app "app.py" * Environment: development * Debug mode: off /usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/sqlalchemy/ext/declarative/base.py:325: SAWarning: Attribute 'username' on class <class 'models.User'> appears to be a non-schema 'sqlalchemy.sql.column()' object; this won't be part of the declarative mapping (key, cls)) /usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/sqlalchemy/ext/declarative/base.py:325: SAWarning: Attribute 'email' on class <class 'models.User'> appears to be a non-schema 'sqlalchemy.sql.column()' object; this won't be part of the declarative mapping (key, cls)) Exception in thread Thread-1: Traceback (most recent call last): File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/threading.py", line 917, in _bootstrap_inner self.run() File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/threading.py", line 1158, in run self.function(*self.args, **self.kwargs) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/seqlog/consumer.py", line 67, in flush self.callback(current_batch) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/seqlog/structured_logging.py", line 366, in publish_log_batch request_body_json = json.dumps(request_body, cls=self.json_encoder_class) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/json/__init__.py", line 238, in dumps **kw).encode(obj) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/json/encoder.py", line 199, in encode chunks = self.iterencode(o, _one_shot=True) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/json/encoder.py", line 257, in iterencode return _iterencode(o, 0) File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/json/encoder.py", line 179, in default raise TypeError(f'Object of type {o.__class__.__name__} ' TypeError: Object of type ColumnSet is not JSON serializable ''' The site runs fine, but when i try to log i get an exception. Is there something i'm missing?
Posted by Kelvin Macartney 8 months ago
Hello, I'm using Seq to log from different application via log4net adapter. I can see the data arriving from the sources but I'm unable to filter them What's the correct sintax to filter by name? Application = 'the name I've" it doesn't work Thanks in advance Paolo
Posted by Paolo Ponzano 8 months ago
I know that we can include everyone in our Active Directory as valid Seq users, I know that we can create permissions for specific people to use seq. My questions is if there is a way to include just an AD group as people who can use Seq? That way we wouldn't have to administer membership when people are come or go, but could just point it at an existing group.
Posted by Chris Clarke 8 months ago
I'm really excited to try the Seq Docker option, but the only SSL/TLS documentation I can find pertains to windows installations. I imagine it might take some interesting gyrations to do get SSL running with Seq Docker. I might be better off terminating SSL before it hits Seq, but was just wondering if anyone has tried to get SSL running with Seq's Docker or what other people are doing to solve the problem.
Posted by Nick Nelson 8 months ago
It's nice to have personal workspace so you can create your own filters. I think with the new update 5.0 this is also applied to dashboards. Can't we have default/public dashboard that can be shared with other users?
Posted by Bilal 8 months ago
Hi The new work space feature in 5.0 is awesome. I am creating workspaces for the different applications on our log server. But is there a way to apply a default input filter to a workspace? I would only like events with Application='InvoiceService' on my InvoiceService workspace. Currently I have to select a signal to achieve this. Hope the question makes sense :-) Thanks and have a great day Regards Kenneth
Posted by Kenneth Brodersen 8 months ago
Hi all, Is there a way to do a Regex filter on a specific field within Seq? Theoretical example: * Let's say I have some URLs with a type of information in the URLs (for regex simplicity sake, let's say it's an SSN). SSNs in the URLs would be bad, so I want to find them so I can ensure we prioritize their removal in our app, which is a large codebase. * We use the Serilog.Web loggers to log the output of our requests. So I'd like to look for the type of information (SSN in this case) in the logged raw URL. The search below would pick up on some of the SSNs in our example, but it searches the entire body of the message and thus is prone to false positive hits as well: ``` /\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57 ``` When I try to search on the `RawUrl` field though, the following search returns no results: ``` RawUrl = /\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57 ``` I also tried: ``` RawUrl = (/\d{3}-?\d{2}-?\d{4}/) and @EventType = 0x5FF28D57 RawUrl like /\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57 RawUrl like (/\d{3}-?\d{2}-?\d{4}/) and @EventType = 0x5FF28D57 ``` Is there a way to apply a regex filter or expression to a specific field within Seq? Thanks!
Posted by Sean Killeen 8 months ago
Is there a way to compare values in either a dashboard or query to one another? For example, I want to know if a particular count is static over a period of time. Something along the pseudocode lines of "If current count equals count from 1 hour ago..."
Posted by Kevin Rich 8 months ago
It would be very useful to have saveable SQL style queries in table format. There are a handful of queries I have saved in a notepad file that I use on a daily basis, it would be awesome if I could just create a dashboard that displayed a table of the results so the rest of the team could have visibility to the data without needing their own copy of the query.
Posted by Dan 9 months ago
Hi. I'm the maintainer of the [Seqlog](https://github.com/tintoy/seqlog) library for Python. I only have a license for Seq 4.x so I haven't tried this myself, but [from what users tell me](https://github.com/tintoy/seqlog/issues/17), it seems that something has changed in Seq 5.x and when they attempt to use it with the latest version they see the following error (with an HTTP 500 from Seq): ```json { "@t": "2018-11-18T06:10:09.6170577Z", "@mt": "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms", "@r": ["0.6036"], "@l": "Error", "@x": "System.NullReferenceException: Object reference not set to an instance of an object.\n at Seq.Server.Web.Api.RawEventsController.TryParseBody(ApiKey apiKey, StorageEventCreationData[]& events, String& errorMessage)\n at Seq.Server.Web.Api.RawEventsController.Ingest()\n at lambda_method(Closure , Object , Object[] )\n at Microsoft.AspNetCore.Mvc.Internal.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeActionMethodAsync()\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeNextActionFilterAsync()\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Rethrow(ActionExecutedContext context)\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\n at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeInnerFilterAsync()\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter()\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()\n at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()\n at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)\n at Seq.Server.Web.Middleware.WebSocketAcceptMiddleware.Invoke(HttpContext context)\n at Seq.Server.Web.Middleware.RequestAuthenticationMiddleware.Invoke(HttpContext httpContext)\n at Seq.Server.Web.Middleware.BrowserSecurityOptionsMiddleware.Invoke(HttpContext context)\n at Seq.Server.Web.Middleware.RequestCompletionMiddleware.Invoke(HttpContext httpContext)", "RequestMethod": "POST", "RequestPath": "/api/events/raw", "StatusCode": 500, "Elapsed": 0.6036, "ErrorToken": "b2c14ff04fbc42348e951aec12f7f637", "RequestProtocol": "HTTP/1.1", "RequestHost": "localhost:5341", "RequestHeaders": { "User-Agent": "python-requests/2.18.4", "Content-Length": "1103" }, "SourceContext": "Seq.Server.Web.Middleware.RequestCompletionMiddleware", "RequestId": "0HLIC0HN27AR5:00000001", "CorrelationId": null, "ConnectionId": "0HLIC0HN27AR5" } ``` The request body is: ```json { "Events": [ { "Timestamp": "2018-11-17 09:05:47.256725+02:00", "Level": "INFO", "MessageTemplate": "Hi, {name}. {greeting}", "Properties": { "MachineName": "IL-GZigelman", "ProcessId": 17860, "LoggerName": "root", "name": "Root logger", "greeting": "Nice to meet you", "ThreadId": 20616, "ThreadName": "MainThread" } }, { "Timestamp": "2018-11-17 09:05:47.256725+02:00", "Level": "INFO", "MessageTemplate": "Hi, {name}! {greeting}", "Properties": { "MachineName": "IL-GZigelman", "ProcessId": 17860, "LoggerName": "A", "name": "world", "greeting": "Nice to meet you", "ThreadId": 20616, "ThreadName": "MainThread" } }, { "Timestamp": "2018-11-17 09:05:47.256725+02:00", "Level": "INFO", "MessageTemplate": "Bye, {name}! {greeting}", "Properties": { "MachineName": "IL-GZigelman", "ProcessId": 17860, "LoggerName": "A.B", "name": "moon", "greeting": "Nice to meet you", "ThreadId": 20616, "ThreadName": "MainThread" } }, { "Timestamp": "2018-11-17 09:05:47.256725+02:00", "Level": "INFO", "MessageTemplate": "By, moon!", "Properties": { "MachineName": "IL-GZigelman", "ProcessId": 17860, "LoggerName": "C", "0": "moon" } } ] } ```
Posted by Adam Friedman 9 months ago
Hi, We have been having a problem Seq filling up our D: drive after a couple of days. It seems like the retention policy isn't deleting the log events from the server so it's filling up the drive where logs are stored. Wondering if there is anything we can do besides increasing our D: drive. Error before logs stops: Free space has fallen below the limit of {LimitBytes} to {AvailableBytes}, events will no longer be accepted","@l":"Error","LimitBytes":300000000,"AvailableBytes":289550336,"SourceContext":"Seq.Server.Features.DiskStorage.StorageTracker"} Thanks
Posted by Greg Silesky 9 months ago
A couple of days ago I stopped getting emails from the alerts that were firing against our SEQ instance. I made a few changes to a couple of alerts (tweaking the firing criteria) and apps (adding several more users to the emails), but I looked at everything and I don't see where I could have made a mistake. Trying to figure it out, I created a new app that would email just me and then added a new alert with criteria that would have had it trigger nearly immediately. In two instances the alert triggered and I got email. In 2 other instances, I received no email. Has anyone run into something like this before? If so, what did you do to fix it?
Posted by Mike 9 months ago