The various logs are stored in different places depending on their volume, query patterns and retention. Knowing where each one lives helps you when querying, exporting or troubleshooting.
Storage Locations
- Database tables: Activity, Email, SMS, API client, Task, Webhook. Stored as ordinary rows; queryable via the admin UI; subject to normal DB backup.
- File-based with DB summary: Error log entries live on disk for full stack traces; a summary row in the DB allows fast browsing.
- External services (optional): Configure forwarding to syslog, Loki, Splunk, ELK, Datadog for long-term retention and richer search.
Where to Query
- Admin UI: Most logs have a dedicated viewer at Architect Panel → Logs → ….
- SQL: DB-stored logs are queryable directly (look at
activity-log,email-log, etc. tables). - Filesystem: Error log file lives at
storage/logs/error.logby default. - External: If forwarded, query in your downstream tool.
Worked Examples
- Quick triage from UI: Most issues solved without leaving the admin UI.
- Complex SQL query: Cross-join activity and email log to find users who didn't open the welcome email but signed in anyway.
- Real-time tailing: SSH into the box and
tail -f storage/logs/error.logduring a deploy. - Long-term retention: Forward all logs to Splunk; admin UI keeps 90 days; Splunk keeps 7 years for compliance.
Tip: Backups should include both the DB and the on-disk error log directory. A backup that captures the DB but not the file-based stack traces loses crucial diagnostic information.