system-logs

Retrieves Logpresso system logs in ascending order. Cluster administrator permission is required.

Command properties

Property	Description
Command type	Driver query
Required permission	Cluster administrator
License usage	Not counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

system-logs [tail=INT] [duration=INT{mon|w|d|h|m|s}] [from=DATE] [to=DATE]

Options

tail=INT: Number of recent system log lines to retrieve. Specify an integer between 1 and 100,000. The tail option cannot be used together with the duration, from, or to options.
duration=INT{mon|w|d|h|m|s}: Limits results to logs within the specified time range from the current time. Use units mon (month), w (week), d (day), h (hour), m (minute), or s (second). For example, 10s means the last 10 seconds relative to query execution time. Cannot be used when both from and to options are specified.
from=DATE: Start time of the retrieval range, in yyyy[MM[dd[HH[mm[ss]]]]] format. If month, day, etc. are omitted, the earliest possible time is used. The start time is included in the results.
to=DATE: End time of the retrieval range, in yyyy[MM[dd[HH[mm[ss]]]]] format. If month, day, etc. are omitted, the earliest possible time is used. The end time is not included in the results.

Output fields

Field	Type	Description
_time	timestamp	Time the log was received or generated
class	string	Name of the class that generated the log
level	string	Log severity level (DEBUG, TRACE, INFO, WARN, ERROR, FATAL)
msg	string	Log message body

Error codes

Parsing errors

Error code	Message	Description
95020	No read permission. Cluster administrator permission is required.	The user does not have cluster administrator permission
95021	The tail value must be an integer between 1 and 100,000. (Input value: [value])	The `tail` option value is less than 1, greater than 100,000, or not an integer
95022	Use the tail option separately from the duration, from, and to options.	The `tail` option was used together with `duration`, `from`, or `to`
95023	Cannot use duration option when both from and to options are specified.	`duration` was used while both `from` and `to` were specified
95030	Invalid from value.	The `from` option value cannot be parsed as a date
95031	Invalid to value.	The `to` option value cannot be parsed as a date
95032	Invalid from value.	The `to` value is earlier than the `from` value

Runtime errors

N/A

Description

The system-logs command reads the Logpresso system's internal log file (araqne.log) and retrieves system logs. Logs are returned in ascending order (oldest first) by default.

Using the tail option reads from the most recent logs in reverse order and returns the specified number of lines. The tail option cannot be used simultaneously with the duration, from, or to options.

Using the from and to options selectively reads only log files within the specified time range. The duration option can be combined with from or to to specify a time range, but cannot be used when both from and to are specified.

Examples

Retrieve all system logs
```
system-logs
```
Retrieves all system logs in ascending order.
Retrieve the last 100 system log entries
```
system-logs tail=100
```
Retrieves the 100 most recently recorded system log entries.
Retrieve system logs from the last hour
```
system-logs duration=1h
```
Retrieves system logs recorded within the last hour.
Retrieve logs for a specific time range
```
system-logs from=20260301 to=20260317
```
Retrieves system logs from March 1, 2026 up to (but not including) March 17, 2026.
Filter only error logs
```
system-logs duration=1d | search level == "ERROR"
```
Retrieves only error-level logs from the last day.