Log snapshots

Log snapshots are an opt-in, bounded diagnostic tool for a specific container and incident. They are not a searchable log platform, long-term log storage or a replacement for the application's own logging system.

Decide whether to enable snapshots

Snapshots require the Solo entitlement, a separate account-owner setting, and an observer that explicitly enables the capability with UPSTATE_LOG_SNAPSHOTS=on. Only when both sides have opted in can an allowed request reach the observer. Missing observer capability is shown as missing, not silently treated as enabled.

Owners and admins can request and view snapshots. Member viewing requires separate consent. The MCP interface has its own owner-controlled permission for reading snapshots; ordinary coding-agent access does not grant it automatically.

Request and inspect a snapshot

In Upstate, open Logs or the relevant host/container or deployment context and make a manual request. The next observer reports deliver the request over the existing outbound channel. A request normally reaches the host within a reporting interval; it can expire if the host is offline. Review the capture timestamp, source container and any truncation or failure notice before interpreting the lines.

The observer reads at most 200 recent lines from up to three explicitly selected containers per request. Each stored snapshot is limited to 64 KiB after redaction. The observer also supports bounded automatic captures for specific unhealthy, crash-like or repeated-restart transitions, with a per-container cooldown.

Retention and privacy

Snapshots expire after 72 hours on every plan. The observer redacts known sensitive patterns before upload and Upstate redacts again before encrypted storage. Redaction is defense in depth, not a guarantee that every secret or private value can be removed. Avoid logging credentials and personal information in the first place.

The stored body is encrypted with the application's configured key. Snapshot bodies are not included in alert emails, general host observations or audit metadata. Revoking the feature blocks future requests and access under its permission rules; it does not instantly prove that a previously viewed or copied line has been erased elsewhere.

How this differs from the CLI logs command

upstate logs --lines 100 --since 15m

That command runs kamal app logs on your workstation using the latest receipt's known destination, roles and hosts. It requires a suitable Kamal checkout and its normal permissions. It does not fetch a stored snapshot from Upstate and does not require enabling the cloud snapshot feature.

For missing observers or application problems, see Troubleshooting.