Delving into MAAS logging practices

MAAS logs are the starting point for most of your troubleshooting

Errors or typos? Topics missing? Hard to read? Let us know!

MAAS features comprehensive logging, including node-specific and system-wide logs. These logs record details about MAAS operations and user interactions.

This document covers the basics, but refers to specific reference guides for details:

Each log type has detailed documentation accessible via the left-hand menu or the links above.

Remote syslog

Remote syslog (3.4 UI)

  1. In the left panel, select Settings.
  2. Choose Syslog under Network in the Settings panel.
  3. Enter your syslog server’s IP or URL under Remote syslog server to forward machine logs.

Remote syslog (3.3-- UI)

  • Navigate to the Settings tab, then the Network services tab.
  • In the Syslog section, add your syslog server’s URL or IP.
  • Click Save to apply changes.

Remote syslog (CLI)

maas $PROFILE maas set-config name="remote_syslog" value="$SYSLOG_FQDN"
# Example for setting syslog server to
maas $PROFILE maas set-config name="remote_syslog" value=
# To reset to default (sending syslog to MAAS region controllers):
maas $PROFILE maas set-config name="remote_syslog" value="

Note: Only machine syslog information is forwarded, not MAAS controllers’ syslogs.

Direct log access

Logs can be found at the following paths depending on your installation type (snap or package):

  • Snap installation:

    • /var/snap/maas/common/log/maas.log
    • /var/snap/maas/common/log/regiond.log
    • /var/snap/maas/common/log/rackd.log
    • /var/snap/maas/common/log/rsyslog/$MACHINE_NAME/$RELEVANT_DATE/messages
  • Package installation:

    • /var/log/maas/maas.log
    • /var/log/maas/regiond.log
    • /var/log/maas/rackd.log
    • /var/log/maas/rsyslog/$MACHINE_NAME/$RELEVANT_DATE/messages

Logs can be extensive and challenging to search. The MAAS web UI does not categorize events by type.

Events query (CLI)

The most efficient way to review events is using the events query CLI sub-command. This command allows filtering and summarizing events. Use jq and various filters to simplify output interpretation.

Basic queries

maas $PROFILE events query

This command returns a lengthy JSON output, which can be simplified using jq and various filters, making it more interpretable.

Using jq with events

A jq command example for readable output:

maas $PROFILE events query limit=20 | jq -r '(["USERNAME","NODE","HOSTNAME","LEVEL","DATE","TYPE","EVENT"] | (., map(length*"-"))), (.events[] | [.username,.node,.hostname,.level,.created,.type,.description]) | @tsv' | column -t -s$'\t'

Filter parameters

The events query command supports multiple filters:

  • hostname: Events for a specific node hostname.
  • mac_address: Events for nodes with specified MAC addresses.
  • id: Events for nodes with specific system IDs.
  • zone: Events for nodes in a particular zone.
  • level: Filter by event level (AUDIT, CRITICAL, DEBUG, ERROR, INFO, WARNING).
  • limit: Maximum number of events to return.
  • before/after: Start returning events before or after a specific event ID.

Example usage of these filters can narrow down event listings significantly.

Auditing finesse

Audit events, tagged with AUDIT, record MAAS configuration changes and machine state transitions. They’re essential for tracking user actions and system updates, especially in multi-user environments.

Use audit events alongside jq and command-line text tools to analyze actions like machine deletions, configuration changes, and user activities. This can provide insights into system changes and help identify areas for attention or improvement.

Last updated 27 days ago.