Log panel
The Log page shows the 500 most recent system log messages generated by your Looker instance. To view the Log page, from the Server section of the Admin menu, select Log.
- To limit the information shown in the Log window, you can enter text in the Filter field, and the Log window will show only those messages that include the text you entered.
- Click Refresh Log to update the log and show the most recent 500 messages.
- You can adjust the severity level of log messages that will be shown for various Looker services. This is explained in more detail below.
The Log window is not the best way to look at usage or user history. Instead, if you have enabled the System Activity Labs feature, see the Creating Looker usage reports with System Activity Explores documentation page. Otherwise, see the Creating Looker usage and metadata reports with i__looker documentation page.
Log levels
The Log Levels section lets you set the minimum severity level required for a message to show up in the log, for several different Looker services. This lets you hide log information that does not interest you.
The default severity level for the db:* and db:looker services is set to info, which means SQL statements containing or filtering on personal information (for example, a customer name) are logged by Looker. This is true for severity settings of info, verbose, or debug. To turn off logging of SQL statements, set the severity level of the db:* and db:looker services to warn, error, or fatal.Looker logs SQL statements both to our internal database (where we store metadata for Looker objects created by users) and to our external databases (where we store customer data and metadata).
Severity descriptions
Log message severity levels are listed below, from least severe to most severe:
debug: Debug log entries are detailed information messages that show Looker’s internal application processes. This severity level is typically used only for debugging internal code.
verbose: These are detailed informational messages that show events occurring in Looker at a more finely grained level. This severity level is typically used only for troubleshooting.
info: These are standard informational messages that show regular events occurring in Looker.
warn: These messages indicate potentially harmful situations.
error: These messages indicate error events that are probably not serious enough to cause Looker to stop running.
fatal: These messages indicate very severe error events that will likely cause Looker to stop running.
Service descriptions
The Default drop-down sets the default severity level for all Looker services. All services set to default will use the severity level in the Default dropdown. The default severity level for the Default drop-down is info.
You can also set severity levels individually for the following services:
pdt: Messages associated with the persistent derived table process.
db:*: Messages generated by queries to the analytics database or by queries to any customer database.
db:looker: Messages generated by queries to the Looker backend database.
http: Messages generated from http requests that the frontend webserver is receiving or processing.
http_core: Messages generated from http requests to the core webserver that serves the internals of the application.
jsch: Messages generated by SSH connections to the Git service. The default setting is warn level, which displays no information. Change to the info level to troubleshoot SSH connection issues.
logger: Messages generated when you make changes to the log level.
org.apache.active: Messages generated by ActiveMQ. ActiveMQ is a messaging service that Looker uses to communicate tasks between subsystems. It is used by the scheduler, PDT regeneration, and other long-running tasks.
raven: Messages generated by the error reporting service.
render: Messages generated by the renderer, which renders PDFs and PNGs.
scheduler: Messages generated by the scheduler process.
After you have modified the log level for a service, click Set Levels to save your changes.
Setting the Log Format on Customer-Hosted Instances
By default, system messages are displayed in text using the following format:
2019-09-25 15:14:12.301 -0700 [INFO|007d0|main] :: Starting Looker : Version 6.21.0-localdev-ea88a4
...
2019-10-01 14:37:53.424 -0700 [INFO|0002a|http] :: Request from 0:0:0:0:0:0:0:1 GET /folders/1, {}
...
2019-10-01 14:37:53.425 -0700 [INFO|0002a|db:looker] :: (0.000180s) SELECT count(*) AS "COUNT" FROM "USER" LIMIT 1
Some system messages, such as exceptions and SQL queries, are generated as multiple-line output. This can cause problems for log processors that require single-line entries for pattern matching.
If your Looker instance is customer hosted and you require single-line output, you can use the --log-format=json startup option to format log entries into single-line JSON structures. The example below shows the same events as above, but in the JSON format:
{"t":"2019-09-25 15:14:56.513 -0700","s":"INFO","rid":"007d0","c":"main","msg":"Starting Looker : Version 6.21.0-localdev-ea88a4"}
...
{"t":"2019-10-01T14:35:37.577 -07:00","s":"INFO","rid":"0002c","c":"http","ip":"0:0:0:0:0:0:0:1","verb":"GET","path":"/folders/1","params":{}}
...
{"t":"2019-10-01T14:35:37.581 -07:00","s":"INFO","rid":"0002c","c":"db:looker","duration":"0.000344","sql":"SELECT count(*) AS \"COUNT\" FROM \"USER\" LIMIT 1"}