What the platform logs

Goal: know which of the many logs a Cloud Platform environment produces answers the question you have, and get at it, streaming live or as a downloaded file.

The catalog below is Cloud Next. Cloud Classic differs in a few availability details; see About Cloud Platform logging on docs.acquia.com.

What you’ll have when you’re done

• A map from question (“why 500s?”, “did cron run?”) to the log that answers it.
• The log in front of you, streamed to your terminal or downloaded from the interface.

Prerequisites

• acli installed and authenticated, or access to the Cloud Platform user interface

Steps

1. Find your log in the catalog

   Log	File	Answers
   Apache access	access.log	Which requests got past Varnish to the web tier? Includes a request_time field per request.
   Apache error	error.log	Did the web server itself fail? Capacity problems, .htaccess errors, missing files.
   PHP error	php-errors.log	Did your code fail? Errors thrown during PHP processing: application code, configuration, or content. Usually the first log to open.
   PHP-FPM access / error	fpm-access.log, fpm-error.log	Is PHP process management itself struggling? Infrastructure-level FPM issues, as opposed to application errors.
   Drupal request	drupal-requests.log	What did Drupal do with each page load? One line per request with http_code, uid, php_time, and queue_wait, the two fields that separate “PHP is slow” from “PHP is starved”.
   Drupal watchdog	drupal-watchdog.log	What is Drupal itself reporting? Requires the core syslog module enabled.
   MySQL slow query	(generated on demand)	Which database queries take longer than one second? Download-only, generated when you ask, covering since the last daily rotation, primary database server only.
   Cloud Hooks	cloud-hook.log	What did my Cloud Hooks print? STDOUT captured per hook execution.
   Scheduled cron jobs	cronjob.log	Did my scheduled job run, and what did it print? STDOUT captured per job execution.
   Balancer / Varnish request	(stream / forward only)	What arrived at the edge, cached or not? Balancer logs stream only; Varnish request logs need dedicated load balancers with log forwarding.

   For the field-by-field format of any log type, see About Cloud Platform logging, which links to one reference page per log.

   One field worth knowing everywhere: request_id. The load balancer attaches a unique ID to each request, and it appears across several logs, so you can follow one request from Apache through Drupal.

2. Stream it, for problems happening now

   acli app:log:tail myapp.prod

   The everyday-workflows guide covers the command in detail. The Cloud UI has the same capability on the environment’s Logs page, with per-log source selection and regex filtering; PHP error and Apache error logs are streamed by default.

   Note

   Streaming is for interactive debugging, not retention. If logs must land in Splunk/Datadog/ELK, that’s Acquia’s separate log forwarding service: ask your Acquia account manager to add it, or contact Acquia Support. Don’t build persistent shipping on top of the streaming endpoint.

3. Download it, for problems that already happened

   acli api:environments:log-list myapp.prod
   acli api:environments:log-download myapp.prod php-error

   log-list returns the log files this environment has available for download; log-download takes one of those log types and fetches it. Files arrive as logfilename-timestamp.tar.gz; some (like the slow-query log) are generated on demand. The Cloud UI downloads the same files from the environment’s Logs page; see Using logs on docs.acquia.com.

   The slow-query log is the special case: downloading it is the only way to read it (the file lives in a root-only MySQL directory you can’t reach over SSH). It isn’t retained between requests, and it covers queries since the last daily rotation.

When something goes wrong

The watchdog log is empty

it’s only written when the core syslog module is enabled; enable it (and prefer it over Database Logging, which is slower).

No slow-query log appears

it’s generated on demand and only for the primary database server; re-request the download, and remember it covers only since the last daily rotation.

A log you expect isn’t listed

availability differs between Cloud Next and Cloud Classic (shell logs are Classic-only; FPM logs stream on Next only); check the availability matrix on docs.acquia.com.

Next steps

• Diagnose a slow or erroring site: the symptom-first workflow that uses this catalog.
• Tail logs from an environment: the streaming command, in the everyday-workflows guide.
• Run scheduled jobs: where cronjob.log entries come from.