Ship container logs with the agent

The Abrova Trace agent is one container that reads the logs of every other container on the host and sends them to Abrova Trace in batches. You change nothing in your apps. In the Console you then search all hosts in one feed, filter by level and container, and start, stop or restart containers.

1Get the server secret#

The agent runs on your server, so give it the project's server secret (ab_srv_…), not the app key. It is in Abrova Console under Project settings → Keys and is shown once, when you create or rotate it. Keep it in your server's secret store or environment.

2Run one agent on the host#

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v abrova-trace-agent-data:/var/lib/abrova-trace-agent \
  -e ABROVA_TRACE_API_KEY=ab_srv_your_server_secret \
  ghcr.io/abrova-co/abrova-trace-agent:latest

• The Docker socket lets the agent find containers and read their logs.
• The abrova-trace-agent-data volume keeps its disk buffer and read positions when the container is re-created, so no lines are lost or sent twice.
• With --restart=always it comes back after a reboot.

If you run your services with Docker Compose, add the agent to the same file and keep the key in .env, which you don't commit:

# docker-compose.yml
services:
  abrova-trace-agent:
    image: ghcr.io/abrova-co/abrova-trace-agent:latest
    container_name: abrova-trace-agent
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - abrova-trace-agent-data:/var/lib/abrova-trace-agent
    environment:
      - ABROVA_TRACE_API_KEY=${ABROVA_TRACE_API_KEY} # ab_srv_… from .env

volumes:
  abrova-trace-agent-data:

3See the logs in the Console#

Within a few seconds the agent registers every running and stopped container. Open Abrova Console → Trace → Logs:

• The Sources panel lists the host and its containers.
• New lines appear in the feed within about 5 seconds: the agent sends batches of up to 100 entries, or every 5 seconds, whichever comes first.
• Each entry has a level, even for plain text logs: [ERROR], level=warn, JSON level fields and words like exception or failed are read for you, so the level filters work without code changes.
• Stack traces and other multi-line output arrive as one entry, and tokens, passwords, API keys, e-mail addresses and phone numbers are masked before anything leaves the host.

To check the agent itself, read its own output on the server:

docker logs abrova-trace-agent

Search, saved searches and the query syntax are on Log search.

4Choose what is sent#

Most of the log volume usually comes from a few noisy containers and from health checks. Trim them with environment variables on the agent:

For example, to skip a health-check sidecar and a debug container, and drop static-file access lines:

docker rm -f abrova-trace-agent

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v abrova-trace-agent-data:/var/lib/abrova-trace-agent \
  -e ABROVA_TRACE_API_KEY=ab_srv_your_server_secret \
  -e ABROVA_TRACE_EXCLUDE=abrova-trace-agent,healthcheck,debug-shell \
  -e 'ABROVA_TRACE_DROP=GET /static/||GET /favicon.ico' \
  ghcr.io/abrova-co/abrova-trace-agent:latest

The first GB of logs each month is free; what you send above it is paid from your wallet. See Pricing.

5Require the server secret#

Once the agent runs with the server secret, turn on Server routes require the server secret under Project settings → Products → Abrova Trace. Then the app key, which ships inside your apps, can no longer connect as an agent or register containers. Apps keep sending errors and logs with the app key as before. See Server secret & server routes.

6Add more hosts#

With several servers, run the agent in agent mode on each extra host. It needs no key; it streams its containers to one collector over a WebSocket:

# On each extra server
docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -p 7008:7008 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e ABROVA_TRACE_HOSTNAME=server-2 \
  ghcr.io/abrova-co/abrova-trace-agent:latest agent

On the main server, tell the collector where they are, as a comma-separated name:host:port list:

-e ABROVA_TRACE_REMOTE_AGENTS=server2:YOUR_SERVER2_HOST:7008

Let only the collector's address reach port 7008, for example ufw allow from COLLECTOR_IP to any port 7008. Details: Abrova Trace agent.

Troubleshooting#