Five commands. The installer links them into place, so they are on the path as shown; run them as the service user when a path is given explicitly.
loghound-tail — the ingest daemonNormally run by systemd. Reading its status is a read-only client of the running daemon, so it is safe at any time.
loghound-tail [options] --status [--human] report lag, rate and parse errors from the running daemon --once poll every source once and exit --dry-run parse and count, never write to Solr --from-start a newly seen log file is read from byte 0 (default: from EOF) --config=PATH alternate config file --verbose, -v log every batch --help, -h
| Recipe | Command |
|---|---|
| Is it healthy? | loghound-tail --status --human |
| Machine-readable, for a monitoring check | loghound-tail --status |
| Ingest the history still on disk, once | loghound-tail --once --from-start |
| Prove the format matches, writing nothing | loghound-tail --once --from-start --dry-run --verbose |
loghound-score — close, merge, cluster, scoreRun every sixty seconds by a timer. Takes -v or --verbose. Running it by hand is useful after changing a weight, to see the next batch scored under it:
sudo -u loghound php /opt/loghound/bin/loghound-score --verbose
It closes sessions idle past the timeout, publishes the open ones whose aggregate has advanced, merges the beacon rows, computes the fingerprint clusters, runs the ruleset, writes the session documents and rebuilds the daily rollup over settled sessions only.
loghound-retention — the only thing that deletesloghound-retention delete loghound-retention --dry-run report what would be deleted, delete nothing
Exit codes: 0 success, including “nothing to do”; 1 a configuration error; 2 a runtime failure.
A deletion job reachable over HTTP is an unauthenticated way to destroy the index, so it refuses regardless of where somebody put the file. Always do the dry run first — it prints an absolute date rather than an expression, because somebody about to delete data should see a date.
On a shared index pair it detects the sharing and deletes only its own documents; if it cannot name its own documents it refuses to run rather than guessing, because an installation with a ninety-day policy must not be able to delete a neighbour’s year.
loghound-schema — keep the live indexes in step with the codeRun this after every upgrade. It is one read per index and it changes nothing without --apply.
loghound-schema compare, change nothing (the default)
loghound-schema --check the same, spelled out
loghound-schema --apply upload this release's configsets where they are missing
fields, then re-check
loghound-schema --quiet print only what is wrong, and the verdict
loghound-schema --help| Exit code | Meaning |
|---|---|
0 | Up to date — every field this release writes is declared by both live schemas, and after --apply, the push succeeded |
1 | This installation is not usable: bad flags, unusable configuration, or no indexes yet |
2 | Failed — a schema could not be read, or an upload was rejected |
3 | Out of date — at least one index is missing at least one field. Check mode only: --apply never leaves this state, it either fixes it or exits 2 |
if loghound-schema --check; then deploy; else echo "run --apply first"; fi
The only dynamic field in either schema maps everything unrecognised to a type that indexes and stores nothing, so Solr accepts the document, discards the value and answers 200 with no error anywhere. Upgrading is the full explanation.
The verdict is also written to a file the panel reads, so running this on the shell updates the Index schema block in the Solr card. Like the retention command, it refuses to run under a web server: --apply reconfigures and reloads a live index, and an unauthenticated route to that is not something to leave lying around. The API key is never printed, by this command or by anything it calls.
loghound-setup — the configuration wizardloghound-setup [options]
--detect-only find the access logs, print what would be asked, change nothing
--reset start the installation over: forget the log sources, the index names
and the sign-in, then run setup. Your Opensolr indexes and everything
in them are NOT touched, and neither are your log files.
--non-interactive answer every prompt from the environment or the offered default
--interactive prompt even when stdin does not look like a terminal
--config=PATH write somewhere other than config/loghound.php
--no-color plain output
-h, --helpEvery prompt defaults to what is stored now, so pressing Enter through it changes nothing. --non-interactive switches on by itself when stdin is not a terminal, because a wizard that blocks forever on a closed stdin is the worst possible failure inside an automated deploy.
The full list of environment variables is on unattended installs, and --help prints it too. --reset is documented in full on starting over.
install/install.sh — preparing the machineNot on the path; run it from the checkout. It is the one that needs root.
sudo ./install/install.sh [options] --dry-run print every action and change nothing. Do this first. --upgrade refresh code in place; config and var/ untouched --uninstall reverse everything, prompting before deleting any data --prefix DIR install root (default /opt/loghound) --user NAME system user to run as (default loghound) --hostname FQDN the panel's hostname --webserver apache | nginx | none --tls-mode existing | certbot | selfsigned | none --tls-cert PATH with --tls-mode existing --tls-key PATH with --tls-mode existing --skip-setup prepare the machine and stop; configure in the browser --skip-tests do not run the test suite --non-interactive answer every prompt from the environment or defaults --yes, -y assume yes for confirmations (still refuses to overwrite files) -h, --help
install/uninstall.sh is a thin wrapper around --uninstall — the same code path under an obvious name, so there is only one implementation to keep correct. Every flag is the same. See uninstalling.
Not part of an installation, and it refuses to overwrite a real configuration because that file holds the API key and the beacon signing secret:
php tools/panel-preview.php # writes a throwaway config, prints a password php -S 127.0.0.1:8099 -t public
That is demo mode, and every page in it carries a banner saying the numbers are fabricated.