---
title: Global Observability
description: A unified, searchable log stream from every container across all your stacks.
---

The **Logs** tab aggregates output from all running containers into a single scrollable view. Instead of tailing logs one container at a time, you see everything in one place, with contextual metrics and filtering to focus on what matters.

<Note>
  Logs is hub-only and is hidden from the nav strip when a remote node is the active selection. See [Multi-Node Management](/features/multi-node#what-top-level-views-show-when-a-remote-node-is-active).
</Note>

<Frame>
  <img src="/images/global-observability/global-observability-overview.png" alt="Global Observability view with live masthead, signal rail, and streaming log feed" />
</Frame>

## Cockpit layout

The page is laid out as a vertical stack of surfaces, each with a distinct role:

| Surface | What it shows |
|---------|---------------|
| **Masthead** | Stream state (`Streaming`, `Idle`, or `Offline`) with a live status dot. Right side shows time since the last event and current session uptime. |
| **Signal rail** | Four tiles: `EVENTS / MIN` with a 60-second sparkline, `ERRORS` count, `WARNINGS` count, and distinct `CONTAINERS` count. Values reflect the current buffer. |
| **Filter strip** | Search box, stacks multi-select, stream pills (`All`, `Out`, `Err`), and level pills (`All`, `Info`, `Warn`, `Error`). |
| **Feed** | Chronological rows grouped by day-banded headers (`NOW`, `2M AGO`, `TODAY 14:20`). Each row shows a severity dot, timestamp, container name, and message. Error rows are tinted rose; warning rows tinted amber. |
| **Chip strip** | Floating bottom-right controls for `Pause`, `Clear`, and `Download`. |

## Streaming

Logs stream live via Server-Sent Events the moment you open the page. The masthead dot pulses cyan while the stream is active; it settles to grey when no events have arrived in the last ten seconds, and turns rose if the connection fails.

If your browser cannot open an `EventSource` connection, Sencho falls back to polling every five seconds automatically. The transport choice is transparent, and no setting is needed to enable streaming.

## Log format

Each row shows:

- **Severity dot** - green for `INFO`, amber for `WARN`, rose with a soft glow for `ERROR`
- **Timestamp** - when the log line was emitted (24-hour local time)
- **Container name** - the specific container that produced the line, rendered in brand cyan
- **Message** - the raw log output, tinted rose for `STDERR` lines

Rows for errors are tinted rose across the full width; warnings are tinted amber. The whole-row tint makes problems easy to scan without reading every line.

## Day bands

When consecutive log rows span a large time gap, a tracked-mono header is drawn between them showing how long ago the next block of rows was emitted. Labels roll up as time passes: recent events are `NOW`, then `2M AGO`, `12M AGO`, `1H AGO`, and eventually a full calendar date.

## Filtering logs

Use the filter strip above the feed to narrow what you see:

| Control | What it does |
|---------|-------------|
| **Search** | Full-text filter across the message, container name, and stack name (case-insensitive). |
| **Stacks** | Checkbox dropdown; select one or more stacks to show only their containers' logs. Displays "All" when nothing is selected. |
| **Stream pills** | Filter by output stream: `All`, `Out` (STDOUT), or `Err` (STDERR). |
| **Level pills** | Filter by severity: `All`, `Info`, `Warn`, or `Error`. |

Filters combine. For example, you can show only `Error` lines from a specific stack while searching for a keyword.

## Pause and resume

Click **Pause** in the chip strip to freeze the feed while you inspect a run of events. The stream keeps filling in the background, and a cyan pill appears showing how many new events are waiting. Click the pill or **Resume** to flush them and return to live mode.

## Controls

| Button | What it does |
|--------|--------------|
| **Pause / Resume** | Freezes and resumes the feed without disconnecting the stream. |
| **Clear** | Clears the current log buffer in the UI. Does not delete logs from Docker. |
| **Download** | Exports the currently filtered logs as a `.txt` file. The filename includes an ISO timestamp for easy identification. |

## Auto-scroll

The feed automatically scrolls to the bottom as new rows arrive. If you scroll up to inspect older entries, auto-scroll pauses so you are not pulled away. Scrolling back to the bottom re-enables it.

## Display limits

To keep the browser responsive, the log viewer enforces two capacity limits:

- **Memory buffer** - a maximum of 2,000 log entries are held in memory at a time. Older entries are dropped as new ones arrive.
- **Rendered rows** - only the most recent 300 entries from the filtered set are rendered as DOM nodes. If more entries match, a notice appears at the top of the feed showing how many entries exist versus how many are displayed.

For deeper investigation, use the [per-container log viewer](/features/editor#log-viewer) in the Editor tab, or `docker compose logs` directly from the [Host Console](/features/host-console).

<Note>
  Log data retention on the backend is controlled by **Settings → Developer → Notification Log Retention** (default: 30 days). This affects historical notification and alert logs stored in Sencho's database, not the live container stream shown here.
</Note>
