# What the platform logs

**Goal:** know which of the many logs a Cloud Platform [environment](/start-here/glossary/#environment) produces answers the question you have, and get at it, streaming live or as a downloaded file.

The catalog below is [Cloud Next](/start-here/glossary/#cloud-next). [Cloud Classic](/start-here/glossary/#cloud-classic) differs in a few availability details; see [About Cloud Platform logging](https://docs.acquia.com/acquia-cloud-platform/about-cloud-platform-logging) on docs.acquia.com.

## What you'll have when you're done

- A map from question ("why 500s?", "did cron run?") to the log that answers it.
- The log in front of you, streamed to your terminal or downloaded from the interface.

## Prerequisites

- [acli installed and authenticated](/cloud-platform/cli/quickstart/), or access to the Cloud Platform user interface

## Steps

<Steps>

1. ### Find your log in the catalog

   | Log | File | Answers |
   |---|---|---|
   | Apache access | `access.log` | Which requests got past [Varnish](/start-here/glossary/#varnish) to the web tier? Includes a `request_time` field per request. |
   | Apache error | `error.log` | Did the web server itself fail? Capacity problems, `.htaccess` errors, missing files. |
   | PHP error | `php-errors.log` | Did *your code* fail? Errors thrown during PHP processing: application code, configuration, or content. Usually the first log to open. |
   | PHP-FPM access / error | `fpm-access.log`, `fpm-error.log` | Is PHP process management itself struggling? Infrastructure-level FPM issues, as opposed to application errors. |
   | Drupal request | `drupal-requests.log` | What did Drupal do with each page load? One line per request with `http_code`, `uid`, `php_time`, and `queue_wait`, the two fields that separate "PHP is slow" from "PHP is starved". |
   | Drupal watchdog | `drupal-watchdog.log` | What is Drupal itself reporting? Requires the core `syslog` module enabled. |
   | MySQL slow query | (generated on demand) | Which database queries take longer than one second? Download-only, generated when you ask, covering since the last daily rotation, primary database server only. |
   | Cloud Hooks | `cloud-hook.log` | What did my [Cloud Hooks](/start-here/glossary/#cloud-hooks) print? STDOUT captured per hook execution. |
   | Scheduled cron jobs | `cronjob.log` | Did my [scheduled job](/cloud-platform/configure/cron/) run, and what did it print? STDOUT captured per job execution. |
   | Balancer / Varnish request | (stream / forward only) | What arrived at the edge, cached or not? Balancer logs stream only; Varnish request logs need dedicated load balancers with [log forwarding](https://docs.acquia.com/acquia-cloud-platform/log-forwarding-cloud-platform). |

   For the field-by-field format of any log type, see [About Cloud Platform logging](https://docs.acquia.com/acquia-cloud-platform/about-cloud-platform-logging), which links to one reference page per log.

   One field worth knowing everywhere: `request_id`. The load balancer attaches a unique ID to each request, and it appears across several logs, so you can follow one request from Apache through Drupal.

2. ### Stream it, for problems happening now

   ```bash
   acli app:log:tail myapp.prod
   ```

   The [everyday-workflows guide](/cloud-platform/cli/everyday-workflows/#tail-logs-from-an-environment) covers the command in detail. The Cloud UI has the same capability on the environment's `Logs` page, with per-log source selection and regex filtering; PHP error and Apache error logs are streamed by default.

   :::note
   Streaming is for interactive debugging, not retention. If logs must land in Splunk/Datadog/ELK, that's Acquia's separate [log forwarding service](https://docs.acquia.com/acquia-cloud-platform/log-forwarding-cloud-platform): ask your Acquia account manager to add it, or [contact Acquia Support](https://acquia.my.site.com/s/contactsupport). Don't build persistent shipping on top of the streaming endpoint.
   :::

3. ### Download it, for problems that already happened

   ```bash
   acli api:environments:log-list myapp.prod
   acli api:environments:log-download myapp.prod php-error
   ```

   `log-list` returns the log files this environment has available for download; `log-download` takes one of those log types and fetches it. Files arrive as `logfilename-timestamp.tar.gz`; some (like the slow-query log) are generated on demand. The Cloud UI downloads the same files from the environment's `Logs` page; see [Using logs](https://docs.acquia.com/acquia-cloud-platform/using-logs) on docs.acquia.com.

   The slow-query log is the special case: downloading it is the only way to read it (the file lives in a root-only MySQL directory you can't reach over [SSH](/cloud-platform/cli/everyday-workflows/#run-drush-remotely-or-open-a-shell)). It isn't retained between requests, and it covers queries since the last daily rotation.

</Steps>

## When something goes wrong

**The watchdog log is empty**: it's only written when the core `syslog` module is enabled; enable it (and prefer it over Database Logging, which is slower).

**No slow-query log appears**: it's generated on demand and only for the primary database server; re-request the download, and remember it covers only since the last daily rotation.

**A log you expect isn't listed**: availability differs between Cloud Next and Cloud Classic (shell logs are Classic-only; FPM logs stream on Next only); check the [availability matrix](https://docs.acquia.com/acquia-cloud-platform/about-cloud-platform-logging) on docs.acquia.com.

## Next steps

- [Diagnose a slow or erroring site](/cloud-platform/observability/diagnose/): the symptom-first workflow that uses this catalog.
- [Tail logs from an environment](/cloud-platform/cli/everyday-workflows/#tail-logs-from-an-environment): the streaming command, in the everyday-workflows guide.
- [Run scheduled jobs](/cloud-platform/configure/cron/): where `cronjob.log` entries come from.