Live tail
Like `tail -f` but for your whole fleet — a streaming feed of log lines as they arrive, with the same filters as the Logs screen, no histogram and no pause.
Live tail is tail -f for your whole fleet — a real-time stream of every log line as it arrives, across every service, with no time picker to set.
What it is
A page that streams log lines into your browser as fast as the Collector ingests them, in real time. There is no time picker (it's always "now"), no histogram, and no pagination. You look at the stream the way you'd look at tail -f /var/log/app.log on a single server — except this is every server, every service.
When to use it (and when not to)
- Use itWhen you've just deployed something and you want to see the next few minutes of logs in real time to catch the first error.
- Use itDuring an active incident, to watch the system stop bleeding once you apply a fix.
- Use itWhen learning what one specific service emits — point a filter at it and watch.
- Don't use itFor investigation of past events — that's Logs.
- Don't use itAs a always-open monitor — it's not designed to be left running on a war room TV. Use a dashboard for that.
Layout
- ① Filter barSame syntax as the Logs search bar. Type to narrow the stream. Empty = every line from every service.
- ② Stream toggleA play / pause button. Pause to freeze the screen so you can read; play to resume. While paused, incoming lines queue up; the badge tells you how many lines are waiting.
- ③ Stream areaThe lines themselves. One row per line. Newest at the bottom (terminal convention) or top — there's a toggle in the toolbar.
- ④ Severity filter stripA row of pills along the top: TRACE · DEBUG · INFO · WARN · ERROR · FATAL. Click to toggle each on/off. Default has DEBUG and TRACE off.
- ⑤ Volume gaugeA small dial in the corner showing current ingest rate in lines/second. Useful for noticing volume spikes.
What each row shows
The same shape as in the Logs explorer, one line each:
timestamp · severity · service · message · key=value chips
Click any row to open the same detail drawer as in the Logs screen — full attributes, copy-link, "open trace" if the line has a trace_id. Clicking also implicitly pauses the stream so you can read in peace.
Behaviour under load
If your stream rate exceeds ~200 lines/second, Live tail starts sampling: it shows roughly one in N lines, and a banner at the top says "sampling at 1/N — pause and use Logs for an exhaustive view". The page never falls behind; it just drops display lines so the browser stays smooth. Sampling is a UI-only artefact — Orbtrace storage still receives every line.
Severity colours
The severity column matches the rest of the UI:
- TRACEslate
- DEBUGslate (slightly brighter)
- INFOcyan
- WARNamber
- ERRORrose
- FATALrose with a pulse ring
Tips
- Narrow before you turn it on. Set
service:checkout-apibefore clicking play; otherwise you're drinking from the fleet's full firehose. - Use the severity filter strip first. Toggling INFO off is the cheapest way to see warnings and errors without retyping a query.
- Open in a side window during deploys. A two-monitor setup with Live tail on the side catches the first failed line of a bad deploy by the time you reach for your coffee.
- Don't keep it open on a war-room TV. It chews CPU on the browser. Use a dashboard panel instead.
Next: Traces.