---
title: "Polarity Server Logs — Log Locations, Formats &amp; Monitoring"
slug: "polarity-server-logs"
description: "Find and interpret Polarity server log files. Covers log locations, formats, verbosity levels, and how to use logs for troubleshooting and monitoring."
updated: 2026-01-16T22:06:38Z
published: 2026-01-16T22:06:38Z
canonical: "knowledge.threatconnect.com/polarity-server-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Polarity Server Logs

Polarity produces logs for Server processes, and each integration produces their own individual logs. While the Server logs are consistent, the verbosity of the individual integration logs can vary based on the amount of information offered by the resource(s) contacted for data.

## Server Process Logs

Each container produces its own logs. These can be viewed using the `docker logs &lt;container_name&gt;` syntax. The output is standard ASCII-based text, and may be viewed and parsed on the command line with standard POSIX tools.

***Example:***

`docker logs polarity_platform` will display all logs for the `polarity_platform` container since it was last instantiated.

### Log Level

By default, the Polarity Server processes will log individual user queries to integrations. This is reflected in the Server’s `.env` file with this line:

```shell
POLARITY_LOG_INTEGRATION_LOOKUPS=verbose
```

Other logging levels available include (in order of verbosity, from least to greatest):

```plaintext
off
minimal
info
verbose
```

Each logging level is additive, data-wise. For example, `info` contains all of the data in `minimal`.

### What is Logged

#### Platform Container

Sample logs for the `polarity_platform` container are shown below:

```json
Creating /tmp/tmp.5LU5faizLx/ca-certificates.crt
Adding /app/certs/ca/LocalCA-pub.crt to CA store
Running /app/bin/entrypoint-start-server.sh
Testing if Postgres is accepting connections. polarity_platform_local_postgres 5432 polarity
Database postgres exists, running migrations...
{"level":"info","message":"Migrations already up","metadata":{},"timestamp":"2025-04-15T21:10:06.105Z"}
Migrations finished.
{"level":"info","message":"Running PolarityWeb.Endpoint with cowboy 2.12.0 at 0.0.0.0:4001 (https)","metadata":{},"timestamp":"2025-04-15T21:10:09.068Z"}
{"level":"info","message":"Access PolarityWeb.Endpoint at https://server.polarity.io:4000","metadata":{},"timestamp":"2025-04-15T21:10:09.068Z"}
{"req":{"headers":{"accept":"application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml","accept-encoding":"gzip, deflate","accept-language":"en-US,*","authorization":"...","content-type":"application/vnd.api+json","cookie":"...","user-agent":"PolarityX/5.2.2","x-forwarded-for":"192.168.0.105","x-forwarded-host":"server.polarity.io:443","x-forwarded-proto":"https"},"method":"GET","url":"/api/users/refresh"},"response_time":"16ms","status":200,"timestamp":"2025-04-15T21:10:09Z"}
{"req":{"headers":{"accept":"application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml","accept-encoding":"gzip, deflate","accept-language":"en-US,*","authorization":"...","content-type":"application/vnd.api+json","cookie":"...","user-agent":"PolarityX/5.2.2","x-forwarded-for":"192.168.0.221","x-forwarded-host":"server.polarity.io:443","x-forwarded-proto":"https"},"method":"GET","url":"/api/users/refresh"},"response_time":"15ms","status":200,"timestamp":"2025-04-15T21:10:09Z"}
{"req":{"headers":{"accept":"application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml","accept-encoding":"gzip, deflate","accept-language":"en-US,*","authorization":"...","content-type":"application/vnd.api+json","cookie":"...","user-agent":"PolarityX/5.2.2","x-forwarded-for":"192.168.0.221","x-forwarded-host":"server.polarity.io:443","x-forwarded-proto":"https"},"method":"GET","url":"/api/channel-filters/"},"response_time":"176µs","status":200,"timestamp":"2025-04-15T21:10:09Z"}
{"req":{"headers":{"accept":"application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml","accept-encoding":"gzip, deflate","accept-language":"en-US,*","authorization":"...","content-type":"application/vnd.api+json","cookie":"...","user-agent":"PolarityX/5.2.2","x-forwarded-for":"192.168.0.221","x-forwarded-host":"server.polarity.io:443","x-forwarded-proto":"https"},"method":"GET","url":"/api/features"},"response_time":"555µs","status":200,"timestamp":"2025-04-15T21:10:09Z"}
{"req":{"headers":{"accept":"application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml","accept-encoding":"gzip, deflate","accept-language":"en-US,*","authorization":"...","content-type":"application/vnd.api+json","cookie":"...","user-agent":"PolarityX/5.2.2","x-forwarded-for":"192.168.0.221","x-forwarded-host":"server.polarity.io:443","x-forwarded-proto":"https"},"method":"GET","url":"/api/integration-types"},"response_time":"10ms","status":200,"timestamp":"2025-04-15T21:10:09Z"}
```

#### Web Container

Sample logs for the `polarity_web` container are shown below:

```json
Creating /tmp/tmp.BdnKnA/ca-certificates.crt
Adding /app/certs/ca/LocalCA-pub.crt to CA store
Running /srv/entrypoint-start-caddy.sh
No Caddyfile found at /config/Caddyfile; copying from /etc/caddy/Caddyfile
{"level":"info","ts":1744751405.5055804,"msg":"using config from file","file":"/config/Caddyfile"}
{"level":"warn","ts":1744751405.5071347,"logger":"caddyfile","msg":"Unnecessary header_up X-Forwarded-For: the reverse proxy's default behavior is to pass headers to the upstream"}
{"level":"info","ts":1744751405.5082066,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"warn","ts":1744751405.5082276,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/config/Caddyfile","line":5}
{"level":"info","ts":1744751405.5104153,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1744751405.5107226,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000599180"}
{"level":"warn","ts":1744751405.5113587,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [polarity-server server.polarity.io]: no OCSP server specified in certificate"}
{"level":"info","ts":1744751405.512001,"logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv0"}
{"level":"info","ts":1744751405.5121455,"logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv1"}
{"level":"warn","ts":1744751405.5152223,"logger":"tls","msg":"unable to get instance ID; storage clean stamps will be incomplete","error":"open /data/caddy/instance.uuid: permission denied"}
{"level":"warn","ts":1744751405.5156195,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":8080"}
{"level":"warn","ts":1744751405.5157907,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":8080"}
{"level":"info","ts":1744751405.5158887,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"error","ts":1744751405.5158823,"logger":"tls","msg":"could not clean default/global storage","error":"unable to acquire storage_clean lock: creating lock file: open /data/caddy/locks/storage_clean.lock: permission denied"}
{"level":"info","ts":1744751405.5159512,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1744751405.5161426,"logger":"http","msg":"enabling HTTP/3 listener","addr":":8443"}
{"level":"info","ts":1744751405.5163088,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"info","ts":1744751405.5164497,"logger":"http.log","msg":"server running","name":"srv1","protocols":["h1","h2","h3"]}
{"level":"info","ts":1744751405.5167122,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1744751405.5167303,"msg":"serving initial configuration"}
{"level":"error","ts":1744751405.5637834,"logger":"http.log.error.log0","msg":"dial tcp 172.18.0.5:4001: connect: connection refused","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"],"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"],"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"duration":0.00111198,"status":502,"err_id":"mwv21ef93","err_trace":"reverseproxy.statusError (reverseproxy.go:1373)"}
{"level":"error","ts":1744751405.5638123,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"],"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.00111198,"size":0,"status":502,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":8443\"; ma=2592000"]}}
{"level":"info","ts":1744751405.5800755,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/v2/servers","headers":{"Accept":["application/json, application/xml, text/json, text/x-json, text/javascript, text/xml"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/json"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.008323238,"size":3901,"status":200,"resp_headers":{"X-Content-Type-Options":["nosniff"],"Alt-Svc":["h3=\":8443\"; ma=2592000"],"Etag":["\"d79r6x66j4zk30d\""],"Content-Type":["text/html; charset=utf-8"],"Accept-Ranges":["bytes"],"Content-Length":["3901"],"Strict-Transport-Security":["max-age=31536000"],"Vary":["Accept-Encoding"],"Last-Modified":["Thu, 23 Jan 2025 21:00:11 GMT"],"X-Frame-Options":["DENY"],"X-Xss-Protection":["1; mode=block"],"Content-Security-Policy":["default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: wss: https:;"]}}
{"level":"error","ts":1744751407.5488908,"logger":"http.log.error.log0","msg":"dial tcp 172.18.0.5:4001: connect: connection refused","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"],"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"duration":0.001183062,"status":502,"err_id":"jemgifmqv","err_trace":"reverseproxy.statusError (reverseproxy.go:1373)"}
{"level":"info","ts":1744751405.7011292,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.221","remote_port":"51139","client_ip":"192.168.0.221","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/v2/servers","headers":{"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/json"],"Accept":["application/json, application/xml, text/json, text/x-json, text/javascript, text/xml"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.000310876,"size":3901,"status":200,"resp_headers":{"Content-Type":["text/html; charset=utf-8"],"Accept-Ranges":["bytes"],"Content-Length":["3901"],"Strict-Transport-Security":["max-age=31536000"],"X-Frame-Options":["DENY"],"X-Xss-Protection":["1; mode=block"],"Alt-Svc":["h3=\":8443\"; ma=2592000"],"Etag":["\"d79r6x66j4zk30d\""],"Last-Modified":["Thu, 23 Jan 2025 21:00:11 GMT"],"Content-Security-Policy":["default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: wss: https:;"],"X-Content-Type-Options":["nosniff"],"Vary":["Accept-Encoding"]}}
{"level":"error","ts":1744751407.7086473,"logger":"http.log.error.log0","msg":"dial tcp 172.18.0.5:4001: connect: connection refused","request":{"remote_ip":"192.168.0.221","remote_port":"51139","client_ip":"192.168.0.221","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"],"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"],"Cookie":["REDACTED"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"duration":0.001105958,"status":502,"err_id":"cn2usd51e","err_trace":"reverseproxy.statusError (reverseproxy.go:1373)"}
{"level":"error","ts":1744751407.5489545,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"],"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.001183062,"size":0,"status":502,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":8443\"; ma=2592000"]}}
{"level":"info","ts":1744751407.5548131,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.105","remote_port":"44772","client_ip":"192.168.0.105","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/v2/servers","headers":{"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/json"],"Accept":["application/json, application/xml, text/json, text/x-json, text/javascript, text/xml"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.000349444,"size":3901,"status":200,"resp_headers":{"Alt-Svc":["h3=\":8443\"; ma=2592000"],"Etag":["\"d79r6x66j4zk30d\""],"Last-Modified":["Thu, 23 Jan 2025 21:00:11 GMT"],"Accept-Ranges":["bytes"],"Strict-Transport-Security":["max-age=31536000"],"X-Content-Type-Options":["nosniff"],"Vary":["Accept-Encoding"],"Content-Type":["text/html; charset=utf-8"],"Content-Length":["3901"],"Content-Security-Policy":["default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: wss: https:;"],"X-Frame-Options":["DENY"],"X-Xss-Protection":["1; mode=block"]}}
{"level":"error","ts":1744751407.7086742,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.0.221","remote_port":"51139","client_ip":"192.168.0.221","proto":"HTTP/2.0","method":"GET","host":"server.polarity.io:443","uri":"/api/servers","headers":{"Accept":["application/json, application/xml, application/vnd.api+json, text/json, text/x-json, text/javascript, text/xml"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate"],"Accept-Language":["en-US,*"],"User-Agent":["PolarityX/5.2.2"],"Content-Type":["application/vnd.api+json"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"server.polarity.io"}},"bytes_read":0,"user_id":"","duration":0.001105958,"size":0,"status":502,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":8443\"; ma=2592000"]}}
```

### Polarity Audit Logging

Polarity Audit Logging is available in Platform v5.6.0 and above. It is disabled by default.

Polarity Audit Logging provides a much richer facility for individual action logging:

Authentication & User Management

- `user_login`
  - A user logged into the Polarity Server
- `user_login_failure`
  - A user failed to login to the Polarity Server (such as incorrect password)
- `user_logout`
  - A user logged out
- `user_logout_all_sessions`
  - All of a user’s sessions were logged out
- `user_account_creation`
  - A user account was created
- `user_account_creation_cloned`
  - An existing user account was cloned, creating a new user account
- `user_password_changed`
  - A regular user’s password was changed
- `admin_password_changed`
  - A administrator user’s password was changed
- `user_granted_admin_permissions`
  - A user has been made an adminstrator user
- `users_added_to_group`
  - One or more users were added to a User Group
- `users_removed_from_group`
  - One or more users were removed from a User Group

**Integration Management**

- `integration_installed`
  - An Integration was installed
- `integration_deleted`
  - An Integration was deleted
- `custom_integration_loaded`
  - A Custom Integration was installed
- `user_modified_integration`
  - A regular user modified an Integration’s configuration
- `admin_modified_integration`
  - An administrator user modified an Integration’s configuration
- `integration_manager_modified_integration`
  - An Integration Manager user modified an Integration’s configuration
- `integration_permissions_granted`
  - One or more users and/or User Groups were granted permissions to an Integration
- `integration_permissions_revoked`
  - One or more users and/or User Groups had their permissions revoked from an Integration
- `integration_force_subscribed`
  - An Integration’s Team Subscription was enabled
- `user_subscribed_integration`
  - A user was subscribed to an Integration
- `user_unsubscribed_integration`
  - A user was unsubscribed from an Integration
- `integration_updated`
  - An Integration was updated
- `integration_edit_levels_updated`
  - An Integration’s configuration field permissions were modified
- `integration_options_updated`
  - An Integration’s options were modified
- `integration_type_created`
  - An Integration Type was created
- `integration_type_updated`
  - An Integration Type was modified
- `integration_type_deleted`
  - An Integration Type was deleted

**Channel Management**

- `user_created_channel`
  - A user created an Annotation Channel
- `user_deleted_channel`
  - A user deleted an Annotation Channel
- `user_cleared_channel`
  - A user cleared an Annotation Channel’s contents
- `admin_deleted_channel`
  - An administrator user deleted an Annotation Channel
- `admin_deleted_user_channel`
  - An administrator user deleted a user’s Annotation Channel
- `user_subscribed_channel`
  - A user subscribed to an Annotation Channel
- `user_unsubscribed_channel`
  - A user unsubscribed from an Annotation Channel
- `channel_subscriptions_created`
  - A default subscription was created for an Annotation Channel
- `channel_subscription_deleted`
  - A default subscription was deleted for an Annotation Channel
- `channel_permissions_granted`
  - One or more users and/or User Groups were granted permissions to an Annotation Channel
- `channel_permissions_revoked`
  - One or more users and/or User Groups had their permissions revoked from an Annotation Channel

**User Activity & Annotations**

- `user_annotated_entity`
  - A user created an Annotation for an entity
- `user_ignored_indicator`
  - A user Ignored an entity
- `user_cleared_overlay_indicator`
  - A user cleared an entity’s Overlay Summary Card
- `user_reloaded_overlay_window`
  - A user reloaded their Overlay window
- `user_changed_overlay_preferences`
  - A user modified one or more settings in their Preferences
- `user_clicked_integration_details`
  - A user expanded an entity’s Overlay Summary Card
- `user_interacted_with_integration`
  - A user interacted with the Integration results for an entity
- `user_viewed_integration`
  - A user viewed an Integration

#### To enable Polarity Audit Logging:

1. Open the `/app/.env` file for editing.
  1. Add the following environment variables and values:
    1. ```plaintext
POLARITY_ENABLE_AUDIT_LOGGING=true
POLARITY_LOG_FILE=/app/log/polarity_logs.json   # Name of log file
POLARITY_LOG_ROTATION_SIZE=10485760             # Maximum size of log files, in bytes
```
  2. Save and close the `/app/.env` file.
2. Open the `/app/docker-compose.yml` file for editing.
  1. In the `services:app:volumes` block, add the following line (with the appropriate indentation):
    1. `- ./log:/app/log:z`
    2. For example, the resulting block might look like this (truncated for clarity):
      1. ```yaml
services:
 . . .
  app:
   . . . 
    volumes:
      - ./integrations:/app/integrations:z
      - ./license:/app/license:z
      - ./certs:/app/certs:z
      - ./log:/app/log:z
   . . .
```
  2. Save and close the `/app/docker-compose.yml` file.
3. Create the `/app/log` directory and ensure it has the correct permissions.
  1. Create the directory with this command:
    1. `mkdir /app/log`
  2. Assign the correct permissions with this command:
    1. `chown 31337:31337 /app/log`
4. Restart the Polarity Server containers to assimilate the changes.
  1. `cd /app &amp;&amp; ./down.sh &amp;&amp; ./up.sh`

The file will be created when the first audit log entry is made. It may be viewed with the `jq` command, like this:

`jq . /app/log/polarity_logs.json`

### Docker Logging Drivers

There are a number of logging drivers supported by Docker by default. Polarity is shipped with the `json-file` logging driver set up by default, with log rotation set with 6 log files of 10MB each, as seen in the Server’s `docker-compose.yml` file.

Depending on Server use, this may not retain enough log history to be useful. However, the settings are adjustable.

> [!NOTE]
> NOTE
> 
> Since containers are ephemeral, the logs associated with them last only as long as the instance does.
> 
> To retain logs longer, a log aggregator (such as Splunk or Elasticsearch) is needed.
> 
> See [**Polarity Source Analytics**](/v1/docs/polarity-source-analytics) for additional information on forwarding logs.

---

## Integration Logs

Each integration produces logs. These can be found in the individual integration’s directory, under `./logs/integration.log`. These are ASCII-based text files, and may be viewed and parsed on the command line with standard POSIX tools.

***Example:***

The `integration.log` file for a Splunk integration might be found here: `/app/integrations/splunk_3_6_7_node_18_27043de191_1726234895/logs/integration.log`.

### Log Level

By default, integrations will log at the `info` level. Since each data source produces different responses, the amount and usefulness of this log level may vary from integration to integration.

The log level for a given integration may be set in the individual integration’s `./config/config.json` file.

***Example:***

For the Splunk integration mentioned above, this file would need to be edited: `/app/integrations/splunk_3_6_7_node_18_27043de191_1726234895/config/config.json`

Find and edit the level displayed in a block that appears like this (truncated for clarity):

```shell
...
  "logging": {
    "level": "info"
  },
...
```

Other logging levels available include (in order of verbosity, from least to greatest):

```plaintext
fatal
error
warn
info
debug
trace
```

Each logging level is additive, data-wise. For example, `info` contains all of the data in `warn`.
