Abrova Trace Agent (Docker)

The Abrova Trace agent streams logs from all Docker containers on your server, with real-time container management, multi-host support, and automatic log level detection. Deploy it with a single docker run command.

How it works#

The agent uses a collector + remote agent architecture:

1. The collector runs on your main server. It watches local containers, connects to remote agents, and sends batched logs to Abrova Trace over HTTPS.
2. Remote agents run on additional servers. They stream their container logs to the collector over a WebSocket.
3. All containers (running and stopped) are registered in your project, so you can see and manage them.
4. The connection works both ways, so container commands (start, stop, restart, remove, stats) reach any host.

With a single server you only need the collector; that is the default mode.

1Deploy on a single server#

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v abrova-trace-agent-data:/var/lib/abrova-trace-agent \
  -e ABROVA_TRACE_API_KEY=ab_srv_your_server_secret \
  ghcr.io/abrova-co/abrova-trace-agent:latest

The volume keeps the agent's disk buffer and read positions when the container is re-created, so no lines are lost or sent twice.

The agent registers every running and stopped container in your project within a few seconds. Open Abrova Trace → Logs in Abrova Console to watch the logs stream in.

2Multi-host setup#

For multiple servers, deploy a remote agent on each additional server and point a single collector at them.

Remote agent (on each additional server)

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -p 7008:7008 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e ABROVA_TRACE_HOSTNAME=server-2 \
  ghcr.io/abrova-co/abrova-trace-agent:latest agent

Collector (on the main server)

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v abrova-trace-agent-data:/var/lib/abrova-trace-agent \
  -e ABROVA_TRACE_API_KEY=ab_srv_your_server_secret \
  -e ABROVA_TRACE_REMOTE_AGENTS=server2:YOUR_SERVER2_HOST:7008,server3:YOUR_SERVER3_HOST:7008 \
  ghcr.io/abrova-co/abrova-trace-agent:latest

The ABROVA_TRACE_REMOTE_AGENTS value is a comma-separated list of name:host:port. Each remote agent streams logs to the collector over a WebSocket and reconnects by itself after a disconnect (every 5 seconds).

3Manage containers from the Console#

In Abrova Console, open Abrova Trace → Logs. The Sources panel lists every host and its containers; the menu next to a container has:

• View stats — a live dialog with CPU %, memory used / limit and memory %, and network RX / TX (bytes received and sent across all network interfaces)
• Start — start a stopped container
• Restart — restart in place
• Stop — gracefully stop a running container
• Delete — stop and remove the container

Commands travel through Abrova Trace to the agent's WebSocket, so they work the same whether the container is on your main server or on a remote-agent host.

Start, stop, restart and delete need the admin or owner role; every role can see containers, logs and stats. See Roles & Permissions.

4Configuration reference#

Collector environment variables

Remote agent environment variables

Log processing (all modes)

5Log level detection#

The agent sets a level on every entry so the level filters in the Console work without code changes:

• Explicit markers win — [ERROR], ERROR:, level=warn, [debug] and similar at the start of a line use the level written there. critical and panic count as fatal, notice as info, verbose as trace.
• JSON logs — a level, severity, lvl or loglevel field is used, including the numeric levels of pino and bunyan.
• NestJS lines ([Nest] PID - TIMESTAMP LEVEL ...) use the level NestJS printed.
• Keywords otherwise — fatal or panic → fatal; error, exception, failed, unhandled, uncaught, ECONNREFUSED, ETIMEDOUT → error; warn, warning, deprecated → warn; debug, dbg → debug.
• info — the default when nothing matches, so info: 0 errors found stays info.

6What an entry carries#

Each log entry is one event, not one line. Besides the message and level, it carries extra fields in metadata:

7Batching and delivery#

• Batched — logs are sent in batches of up to 100 entries, or every 5 seconds, whichever comes first.
• Retry on failure — failed batches are re-queued and retried, with up to 5,000 pending entries per source in memory (the oldest are dropped beyond that).
• Disk buffer — if Abrova Trace cannot be reached, batches are written to ABROVA_TRACE_DATA_DIR and re-sent in order when it is back (up to ABROVA_TRACE_SPOOL_MB).
• Resume after restart — the agent remembers the last line it read per container and continues from there.
• Graceful shutdown — docker stop abrova-trace-agent flushes pending batches before exiting.

Key features#

Security model#

Troubleshooting#