HostAtlas does not permanently ship every log line off your servers — that’s noisy and expensive. Instead it gives you two log surfaces:

1. On-demand agent log fetch — ask the agent to return the last N lines of a specific file right now, over the same encrypted channel it already uses for metrics.
2. Log Search — search across log streams that are ingested (typically via Cloudflare Logpush for edge / access logs).

On-demand log fetch

What you see

At /logs you get a form and a live tail panel:

• Server picker.
• Path — the file to tail, for example /var/log/nginx/error.log.
• Lines — how many trailing lines to fetch (default a few hundred).
• Grep filter — optional pattern applied on the agent before returning.

Once submitted, the panel shows a spinner while the agent responds, then streams the returned lines.

What you can do

• Request a fetch — the request is dispatched to the agent’s command queue and completes in seconds on a healthy host.
• Cancel a pending request if you picked the wrong file.
• Copy the returned block to paste elsewhere.
• Trigger from Claude / an MCP client — the same fetch is available as the request_logs tool on the HostAtlas MCP server, and as a subcommand of the CLI Tool.

How it works

• The web UI (or MCP tool, or CLI) posts a fetch request. HostAtlas queues a command on the target server.
• The agent picks it up on its next check-in (typically within seconds), reads the tail from disk, applies the optional grep, and returns the payload.
• The result is returned to the requester and not persisted long-term — this keeps sensitive log content off HostAtlas storage.
• Requests are audit-logged with the requester, server, path, and byte count returned.

Caution

Path safety: the agent restricts fetches to paths the workspace has whitelisted for the server. Arbitrary paths outside the whitelist are refused.

Log Search

For teams that do ship logs into HostAtlas (Cloudflare Logpush is the primary supported source), /log-search gives you a full-text query interface across the ingested stream:

• Query — search terms, phrase quoting, and simple field filters (e.g. status:5xx).
• Time window — quick presets and custom range.
• Source — the log stream to search.
• Results — matching lines with source, timestamp, and expandable JSON payload.

How it works

• Logpush (or a compatible log producer) posts batches to HostAtlas.
• HostAtlas indexes them for search over the retention window your plan allows.
• Queries execute against the indexed store and return sub-second on typical filters.

Related

• Activity — see log-fetch requests alongside every other event.
• CLI Tool — request logs from your terminal.
• MCP Server — request logs from Claude, Cursor, or any MCP-capable client.