Agent Logs & Live Log Streaming

When one endpoint is misbehaving — an install that won't land, a service that keeps stopping, an agent that reconnects in a loop — you can watch that single Hermes agent's own log live from the console, without remoting into the machine or opening a file share. The Logs section on an Agent Details page tails the agent's diagnostic log in near real time, lets you turn its verbosity up or down on the fly, and the same entries are always on disk on the endpoint for offline review.

This page is about a single agent's diagnostic log — the running Hermes service on one endpoint. For the server's own log files and retention, see Server Logging & Retention. For the fleet-wide default log level applied to every agent, see Agent Settings. For a security record of who did what in the console, see the tamper-aware Audit log — that is a separate feature from the diagnostic logs described here.

Opening the Logs section#

From Agents, click an endpoint to open its Agent Details page, then choose Logs in the left-hand section list. Opening the section starts the live stream automatically; leaving it (or navigating away, closing the tab, or losing your connection) stops the stream. Streaming requires the agent to be Online — an offline agent has nothing to send until it reconnects.

Reading the live viewer#

Each entry is shown on one line — a timestamp, a short severity badge, the component that emitted it, and the message. If an entry carries an exception, the stack detail is shown beneath it. A status indicator at the top of the card reads Streaming while entries are flowing and Stopped when they are not, and a footer shows how many entries are currently in view.

The severity badge maps to the standard log levels:

Badge	Level	Meaning
`VRB`	Verbose	The most detailed, message-by-message tracing. High volume — use only for short, targeted troubleshooting.
`DBG`	Debug	Developer-level detail useful when investigating a specific problem.
`INF`	Information	Normal operational messages — the everyday default.
`WRN`	Warning	Something unexpected that the agent recovered from.
`ERR`	Error	An operation failed.
`FTL`	Fatal	A critical failure.

Viewer controls#

Control	What it does
Log Level dropdown	Changes how verbose the agent is right now (see Changing the log level).
Pause / Resume	Freezes or resumes auto-scroll so the view stops jumping to the newest line while you read — the stream keeps arriving in the background.
Clear	Empties the on-screen list. This only clears your current view; it never deletes anything from the log file on the endpoint.

Changing the log level#

The Log Level dropdown sets the minimum severity the agent writes, from most to least detailed: Verbose, Debug, Information, Warning, Error, Fatal. When you pick a new level it is pushed to that agent and applied without a restart, so you can raise detail to Debug while you reproduce a problem and drop it back to Information when you're done. The dropdown syncs to the level the agent reports, so it reflects the value actually in force on the endpoint.

The change is persistent: the agent updates its own configuration, so the level survives a service restart or a reboot until you change it again. When an agent first connects it also picks up the fleet-wide Default Log Level from Agent Settings, which is the starting point for newly enrolled machines.

Leave a single agent at Verbose or Debug only while you are actively troubleshooting. Those levels produce a lot of output; return the agent to Information afterwards so its daily log files stay small and readable.

Where the log lives on the endpoint#

The live viewer streams the same file the agent writes to disk, so when you can't reach the console — or you need history from before you opened the viewer — the file is always there on the endpoint. The agent rolls to a new file each day.

Platform	Log file
Windows	`%ProgramData%\Hermes\Logs\hermes-<yyyyMMdd>.log`
Linux	`/var/lib/hermes/logs/hermes-<yyyyMMdd>.log`

Each line is written as timestamp [LEVEL] Source: message, followed by exception detail when present — the same shape you see in the live viewer. On Windows the agent's data folder is locked down to SYSTEM and Administrators; on Linux it is restricted to the account the agent daemon runs as, so reading the file directly requires appropriate local access.

When an agent is offline#

Live streaming and on-the-fly log-level changes both depend on the agent being connected. If the endpoint is offline, the viewer stays Stopped and no new level can be pushed until it reconnects — but the log file above keeps everything the agent recorded locally, so you can still pull history off the machine by hand. If an agent won't come online at all, the local file is usually the first place to look.

Troubleshooting tips#

Open the Logs section before you trigger the action you're diagnosing — a deployment, a remote command, an update — so you catch the entries as they happen.
Raise the level to Debug first, reproduce the issue, then read back; drop to Information when finished.
Use Pause to stop auto-scroll so you can read a burst of entries without the view jumping to the newest line.
For anything from before you opened the viewer, or when the console can't reach the agent, read the daily file on the endpoint directly.