Skip to main content
Arupa writes Kernel and service logs through one structured logger. The default output is JSON, so records can be collected and searched by field. You can switch to text output when reading logs directly in a terminal.

​
Configure logging

Set the process-wide logging options in the [Log] section:
The defaults are Format = "json" and Level = "info". Level filtering is inclusive: warn emits warnings and errors, while debug emits every level. The values are case-insensitive. Configuration errors are reported when the configuration is loaded. At startup, invalid logging settings cause the Kernel to use its defaults. During a reload, an invalid configuration leaves the current configuration in effect. Changes to [Log] take effect when the Kernel creates its logger at startup; reloading the configuration updates runtime settings such as services, but does not replace the logger that is already running.

​
Common fields

Every Kernel log identifies its origin with two fields:
component identifies the trust boundary that produced the record. from identifies the Kernel subsystem. Common values include:
  • http for HTTP access records;
  • service_manager for service discovery and lifecycle records; and
  • config, server, and cli for configuration, server, and command-line activity.
Logs emitted by a service through the authenticated host boundary use:
The Kernel derives the service name from the authenticated gRPC callback or the WASM binding context. A service cannot change this attribution by supplying a different source name. This applies to wasm and grpc services; a static service has no running process and so never emits its own log records. The service protocol itself is unchanged; attribution is added by the Kernel’s host logging layer.

​
Debug source locations

When Level = "debug", the logger automatically adds source with the application call site. This is useful for locating the code that emitted a diagnostic record, but it increases the size of every record and usually increases log volume as well. Do not confuse source with from:
  • source is the debug-only logger call location; and
  • from is the stable Kernel subsystem or service identity.
At info, warn, and error levels, the call-site source field is omitted.

​
HTTP access logs

The Kernel emits one access record after every HTTP request, including requests handled by Kernel routes and service routes, whether a route is handled dynamically or serves packaged files through a static transport. Each record contains: The access record uses component=kernel and from=http. Its log level is selected from the final status:
  • 4xx responses are logged at WARN;
  • 5xx responses are logged at ERROR; and
  • all other responses are logged at INFO.
Request bodies, headers, and query strings are not included in this access record. The path may still contain sensitive information if the application places sensitive values in path segments.

​
Choosing a level

Use info for normal operation. It includes HTTP access records and service lifecycle records. Use warn when you need to investigate rejected requests, unavailable namespaces, or other recoverable conditions. Use error when investigating failed requests or operations. Use debug temporarily when diagnosing route selection, successful event handling, or the exact call site of a log record. Return to info after diagnosis to reduce volume and avoid collecting more diagnostic detail than necessary.