# Logs

When your app misbehaves, **look at the logs before guessing**.

```
get_logs { ref, level: "error" }            errors only, newest first
get_logs { ref, source: "server" }          lines your deployed server printed (console.log, error stacks)
get_logs { ref, search: "timeout" }         search the contents
get_logs { ref, before: "<next_before>" }   the previous page
```

If a build failed, find the deployment with `list_deployments` and read the end of the build log with `get_deployment`.
The reason is usually in the last few lines.

Sources:

```
site       requests to your deployed site
server     what your deployed server printed
api        data API requests
auth       sign-in and sign-up requests
functions  function calls and what functions printed
build      build output
```

Request lines look like `method path status duration`. Query strings, bodies and headers are not stored.
How long logs are kept depends on the plan and is in the response's `retention_days`.

## Metrics

`get_metrics { ref, range: "1h" | "24h" | "7d" }` gives request counts, failure counts and latency (p50/p95/p99) per surface,
plus database size, connection count and cache hit rate. When you hear that things got slow, look at this before the logs.

## Exporting logs

To keep logs longer than the retention period or read them in another tool, send them out.

```
list_log_drains         destinations, sources, last delivery and errors
create_log_drain        add (kind: https | datadog, sources)
set_log_drain_enabled   pause or resume sending
remove_log_drain        delete
```

Only logs written after the drain is created are sent. Up to 5 per project, and only owners and admins can change them.

## Alert rules

When a value passes its threshold, the organisation's notification channels and mail are told. Checked every minute.

```
list_alert_rules         rules and where each stands (ok | firing)
create_alert_rule        create (kind: error_rate | p95 | function_errors | usage | firewall_blocks, threshold, window_minutes)
set_alert_rule_enabled   pause or turn back on
remove_alert_rule        delete
```

Developers and above can change them. Not on the free plan.

## Project webhooks

Tells a public https address when a deployment starts, is ready, fails or is promoted, when environment variables, domains or backups change, and when someone signs up. Use it to connect outside automation such as Make or Zapier. Row changes in a table are database webhooks.

```
list_project_webhooks             webhooks, signing secrets and the events to choose from
create_project_webhook            create (name, url, events: empty is every event, a family like deployment.*)
set_project_webhook_enabled       pause or send again
test_project_webhook              send a ping
list_project_webhook_deliveries   deliveries and why any failed
retry_project_webhook_delivery    send one delivery again
remove_project_webhook            delete
```

Signed as database webhooks are: `x-blackwall-signature: t=<seconds>,v1=<HMAC-SHA256(signing_secret, "<t>.<body>")>`. Up to 10 per project, and only owners and admins can change them.

---

https://end.blackall.ai/docs/logs?lang=en