Server Configuration

Many Seq options can be configured through the Settings section of the web user interface. Lower-level settings, especially those that control the HTTP endpoint, or require a restart to be applied, are stored in the Seq.json configuration file, and manipulated using the seq config command-line.

The seq config command-line

From an administrative command prompt on the Seq server, running seq config list will list the available settings and their values:

seq config list

📘

Docker syntax

The seq config commands can be invoked on the Docker container:

docker run --rm -it -v <volume> datalust/seq config list

or, within init scripts via seqsvr, e.g. seqsvr config list.

Setting values can be changed with seq config set by specifying the setting name and value:

seq config set -k api.listenUris -v https://example.com,https://example.com:45341
seq config set -k cache.systemRamTarget -v 0.8
seq config clear -k storage.queryParallelism
seq service restart

Settings that accept multiple values can be specified by listing values separated by a comma ,.

Values can be reset to their defaults using seq config clear and the setting name.

📘

Seq reads settings Seq.json at startup, so the Seq service must be restarted for changes to take effect.

Environment variable overrides

Each setting value can be overridden at runtime by specifying an environment variable of the form SEQ_<setting path>, where <setting path> contains one element for each dotted segment of the setting name, separated by underscores.

For example the setting api.listenUris can overridden with the SEQ_API_LISTENURIS variable.

Secret Store overrides

Some setting values, for example, certificates.defaultPassword, metastore.postgres.connectionString, or metastore.msSql.connectionString, should not be stored in plain text.

Seq provides the secret set command as an alternative to config set for this purpose:

echo p@ssw0rd | seq secret set -k certificates.defaultPassword --value-stdin

The --value-stdin parameter avoids leaving sensitive information in the shell command history, or exposing it to other privileged processes via the seq process's command-line.

The secret set command encrypts values using the secret key and stores them in Secrets/. Secret Store values are applied last, so they will override values in Seq.json as well as any values supplied in environment variables.

📘

In Docker

To load values into the secret store under Docker, call seqsrv secret set from an init script. The script can pull the secret value from an external store, or read it from a file alongside the script which the script can delete after reading.

Settings

Settings can be viewed and updated from the command-line using the seq config commands. Settings also support overrides in environment variables and the secret store. The matching environment variable name for each setting is shown in the detailed documentation below.

api.ingestionPorts

The addresses that the server will limit to event ingestion.Note that each entry must also exist in api.listenUris.

The value can be overridden using the SEQ_API_INGESTIONPORTS environment variable.

api.avoidLdap

If True, the Windows local security authority will be used instead of LDAP in some features (experimental).

The value can be overridden using the SEQ_API_AVOIDLDAP environment variable.

api.canonicalUri

The address that the server can be accessed on externally. If specified, Seq will assume that all requests are served under this URL, all inbound links and redirects Seq generates will be based on this URL.

The value can be overridden using the SEQ_API_CANONICALURI environment variable.

api.corsAllowedOrigins

Origins from which the full API will be accessible using CORS. Note that this is not necessary for ingestion - events can always be sent to the ingestion endpoint using CORS.

The value can be overridden using the SEQ_API_CORSALLOWEDORIGINS environment variable.

api.frameAllowFrom

Origins that may embed the Seq UI within an <iframe>.

The value can be overridden using the SEQ_API_FRAMEALLOWFROM environment variable.

api.hardSessionExpirySeconds

If non-null, this will override the various session expiry timeouts used by the different authentication providers. The initial value is null (no additional hard session expiry override).

The value can be overridden using the SEQ_API_HARDSESSIONEXPIRYSECONDS environment variable.

api.hstsIncludeSubDomains

The includeSubdomains field set in the HSTS header, if enabled.

The value can be overridden using the SEQ_API_HSTSINCLUDESUBDOMAINS environment variable.

api.hstsMaxAge

The max-age specified in the HSTS header in seconds, if enabled. The initial value is 31536000 (365 days).

The value can be overridden using the SEQ_API_HSTSMAXAGE environment variable.

api.idleSessionExpirySeconds

If non-null, this will set an expiry timeout that will revoke user sessions after a period of inactivity. The initial value is 172800 (48 hours).

The value can be overridden using the SEQ_API_IDLESESSIONEXPIRYSECONDS environment variable.

api.ingestionPort

If non-null, only event ingestion will be allowed on the specified port. Note that a corresponding entry must exist in api.listenUris.

The value can be overridden using the SEQ_API_INGESTIONPORT environment variable.

api.integratedAuthenticationScheme

The authentication scheme used for Windows authentication. IntegratedWindowsAuthentication (the default) and Negotiate are supported.

The value can be overridden using the SEQ_API_INTEGRATEDAUTHENTICATIONSCHEME environment variable.

api.listenUris

The addresses that the server will listen on. The first entry listed will be used as the default when generating URIs for apps and notifications.

The value can be overridden using the SEQ_API_LISTENURIS environment variable.

api.redirectHttpToHttps

Whether to redirect HTTP requests to the first HTTPS endpoint listed in api.listenUris. If set to True, the HSTS header will also be set.

The value can be overridden using the SEQ_API_REDIRECTHTTPTOHTTPS environment variable.

cache.largeObjectHeapCompaction

Specify how the .NET large object heap is compacted. Allowed values are Periodic, Never, and Default (a version-specific value, currently equivalent to Periodic). Compaction can prevent out-of-memory errors in some circumstances, but may result in short availability pauses while compaction takes place.

The value can be overridden using the SEQ_CACHE_LARGEOBJECTHEAPCOMPACTION environment variable.

cache.systemRamTarget

Seq uses RAM heavily to speed up query processing. On shared machines (or local developer workstations) it may be desirable to limit this behavior. Specifying a smaller fractional value here (e.g. 0.5) will cause Seq to release memory once system memory usage surpasses the threshold (e.g. 50%). If the value specified is greater than 1.0, it will betreated as an absolute byte value. The value may be set to zero to completelydisable caching - this may have significant performance impact.

The value can be overridden using the SEQ_CACHE_SYSTEMRAMTARGET environment variable.

certificates.certificatesPath

Optionally, a folder to search for certificate files; if not specified, Certificates/ under thestorage root will be used.

The value can be overridden using the SEQ_CERTIFICATES_CERTIFICATESPATH environment variable.

certificates.defaultPassword

The default password used when decrypting encoded certificate bundles (.pfx files).

The value can be overridden using the SEQ_CERTIFICATES_DEFAULTPASSWORD environment variable.

diagnostics.internalLoggingLevel

Seq's own internal logging level. Modifying this value may cause significantly higher I/O load and is not recommended. The default is Information.

The value can be overridden using the SEQ_DIAGNOSTICS_INTERNALLOGGINGLEVEL environment variable.

diagnostics.internalLogPath

The location for Seq's own internal log files.

The value can be overridden using the SEQ_DIAGNOSTICS_INTERNALLOGPATH environment variable.

diagnostics.internalLogServerApiKey

API key for the internal log server.

The value can be overridden using the SEQ_DIAGNOSTICS_INTERNALLOGSERVERAPIKEY environment variable.

diagnostics.internalLogServerUrl

Send Seq's internal logs to another Seq server.

The value can be overridden using the SEQ_DIAGNOSTICS_INTERNALLOGSERVERURL environment variable.

diagnostics.metricsSamplingIntervalSeconds

Interval (seconds) at which Seq will write metrics information to its internal log file.

The value can be overridden using the SEQ_DIAGNOSTICS_METRICSSAMPLINGINTERVALSECONDS environment variable.

diagnostics.nativeStorageMetricsSamplingIntervalMinutes

Interval (minutes) at which Seq will write native storage metrics to its internal log file.

The value can be overridden using the SEQ_DIAGNOSTICS_NATIVESTORAGEMETRICSSAMPLINGINTERVALMINUTES environment variable.

diagnostics.telemetryServerUrl

Send Seq's error telemetry (if enabled) to another Seq server.

The value can be overridden using the SEQ_DIAGNOSTICS_TELEMETRYSERVERURL environment variable.

features.enabled

The non-default features enabled on the Seq instance.

The value can be overridden using the SEQ_FEATURES_ENABLED environment variable.

firstRun.adminPasswordHash

A salted, cryptographically-hashed, Base64-encoded default password for the administrator account, ignored after the first time Seq is run. Use seq config hash to compute a value that can be stored in this setting. Alternatively, consider using the --default-admin-password-stdin argument to the seq run command. The default when no password is supplied is to not enable authentication.

The value can be overridden using the SEQ_FIRSTRUN_ADMINPASSWORDHASH environment variable.

firstRun.adminUsername

A default username for the administrator account, ignored after the first time Seq is run. The default is admin.

The value can be overridden using the SEQ_FIRSTRUN_ADMINUSERNAME environment variable.

firstRun.requireAuthenticationForHttpIngestion

If true, API keys or user authentication will be required for HTTP/S ingestion; ignored after thefirst time Seq is run.

The value can be overridden using the SEQ_FIRSTRUN_REQUIREAUTHENTICATIONFORHTTPINGESTION environment variable.

metastore.msSql.connectionString

A connection string for the Microsoft SQL Server/Azure SQL instance into which metadata will be stored. If null,local metadata storage will be used. The default is null.

The value can be overridden using the SEQ_METASTORE_MSSQL_CONNECTIONSTRING environment variable.

metastore.msSql.msiResource

If the connection must use an Azure Managed Service Identity, the resource for which to request an access token; normally this will be https://database.windows.net/; the default is to not use an Azure MSI.

The value can be overridden using the SEQ_METASTORE_MSSQL_MSIRESOURCE environment variable.

metastore.msSql.msiTenantId

If using an Azure Managed Service Identity and the identity has access to multiple tenants, the tenant id; the default is to not specify a tenant id.

The value can be overridden using the SEQ_METASTORE_MSSQL_MSITENANTID environment variable.

metastore.msSql.schema

The name of the schema under which Seq should store metadata. The default is dbo.

The value can be overridden using the SEQ_METASTORE_MSSQL_SCHEMA environment variable.

metastore.postgres.connectionString

A connection string for the PostgreSQL instance into which metadata will be stored. If null,local metadata storage will be used. The default is null.

The value can be overridden using the SEQ_METASTORE_POSTGRES_CONNECTIONSTRING environment variable.

metastore.postgres.schema

The name of the schema under which Seq should store metadata. The default is seq.

The value can be overridden using the SEQ_METASTORE_POSTGRES_SCHEMA environment variable.

secretKey.provider

An executable that will write the Base64-encoded secret key to STDOUT when invoked. If specified, this will override the secret key found in Seq.json or any environment variables.

The value can be overridden using the SEQ_SECRETKEY_PROVIDER environment variable.

secretKey.providerArgs

Command-line arguments to pass to the secret key provider executable, if configured.

The value can be overridden using the SEQ_SECRETKEY_PROVIDERARGS environment variable.

services.servicesBaseUri

The base URL Seq uses for service discovery, if enabled. The default is https://datalust.co.

The value can be overridden using the SEQ_SERVICES_SERVICESBASEURI environment variable.

storage.disableFreeDiskSpaceChecking

Disable free disk space checking for filesystems where it may be very inefficient or unnecessary. If checking is disabled Seq can't protect from running out of disk space.

The value can be overridden using the SEQ_STORAGE_DISABLEFREEDISKSPACECHECKING environment variable.

storage.flare.diskReaderLimit

The maximum number of storage threads that will be allowed to concurrently read from the disk. Increasing this value can improve throughput, at the expense of additional risk of stampedes causingservice instability.

The value can be overridden using the SEQ_STORAGE_FLARE_DISKREADERLIMIT environment variable.

storage.flare.indexerPriority

The priority assigned to storage management and indexing; the default value 0 will cause all required management tasks to proceed normally. Higher values represent the fraction of maintenance time during which these tasks should yield.

The value can be overridden using the SEQ_STORAGE_FLARE_INDEXERPRIORITY environment variable.

storage.flare.queryParallelism

The default number of threads assigned to execution of each parallel query. Increasing this limit can result in higher service resource usage.

The value can be overridden using the SEQ_STORAGE_FLARE_QUERYPARALLELISM environment variable.

storage.secretKey

The encryption key used to protect secrets and sensitive values in the Seq metadata store.

Windows: this value is itself encrypted and must be retrieved using the seq show-key command for secure backup.

Linux/macOS: this value is stored unencrypted in Seq.json; use the SEQ_STORAGE_SECRETKEY variable for improved confidentiality, or configure secretKey.provider.

The value can be overridden using the SEQ_STORAGE_SECRETKEY environment variable.

Seq.json Example

An example Seq.json configuration file is shown below.

{
  "cache": {
    "systemRamTarget": 0.9,
    "largeObjectHeapCompaction": "Default"
  },
  "certificates": {
    "defaultPassword": null,
    "certificatesPath": null
  },
  "diagnostics": {
    "internalLogPath": null,
    "internalLoggingLevel": "Information",
    "internalLogServerUrl": null,
    "internalLogServerApiKey": null,
    "telemetryServerUrl": null,
    "metricsSamplingIntervalSeconds": 300,
    "nativeStorageMetricsSamplingIntervalMinutes": 60
  },
  "api": {
    "listenUris": [
      "https://seq.example.com",
      "https://seq.example.com:45341"
    ],
    "canonicalUri": null,
    "ingestionPort": 45341,
    "corsAllowedOrigins": [],
    "frameAllowFrom": [],
    "integratedAuthenticationScheme": null,
    "avoidLdap": false,
    "redirectHttpToHttps": false,
    "hstsMaxAge": 31536000,
    "hstsIncludeSubDomains": false,
    "hardSessionExpirySeconds": null,
    "idleSessionExpirySeconds": 172800
  },
  "storage": {
    "secretKey": "pmk.msu7w4KDakC/Xt7rbzpyuw==",
    "flare": {
      "indexerPriority": 0.0,
      "queryParallelism": 4,
      "diskReaderLimit": 5
    },
    "disableFreeDiskSpaceChecking": false
  },
  "metastore": {
    "msSql": {
      "connectionString": null,
      "schema": null,
      "msiResource": null,
      "msiTenantId": null
    },
    "postgres": {
      "connectionString": null,
      "schema": null
    }
  },
  "firstRun": {
    "adminUsername": null,
    "adminPasswordHash": null,
    "requireAuthenticationForHttpIngestion": false
  },
  "secretKey": {
    "provider": null,
    "providerArgs": null
  },
  "services": {
    "servicesBaseUri": null
  },
  "features": {
    "enabled": []
  }
}