Log Files

# Quick: get log path
openclaw config show | grep log_file

# Tail the live log
tail -f ~/.local/share/openclaw/logs/openclaw.log

# config.yaml
log_level: info           # error | warning | info | debug | trace
log_file: /var/log/openclaw/openclaw.log
log_format: json          # json or text
log_max_size_mb: 50       # rotate when file exceeds 50 MB
log_max_backups: 5        # keep last 5 rotated files

LOG=~/.local/share/openclaw/logs/openclaw.log

# All errors
grep "ERROR" $LOG

# Tool call failures
grep "TOOL_FAIL\|ToolExecutionError" $LOG

# Rate limit hits
grep "429\|RateLimitError" $LOG

# Last 100 lines filtered to errors/warnings
tail -100 $LOG | grep -E "ERROR|WARN"

# Count errors by type in last 500 lines
tail -500 $LOG | grep "ERROR" | awk '{print $5}' | sort | uniq -c | sort -rn

# Events in a time range (JSON logs)
cat $LOG | jq 'select(.timestamp >= "2024-01-15T09:00:00" and .level == "error")'

# OpenClaw rotates logs automatically when log_max_size_mb is set.
# You can also use logrotate on Linux:
# /etc/logrotate.d/openclaw
/home/user/.local/share/openclaw/logs/openclaw.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
    copytruncate
}

# Show last 20 errors with timestamp and message
cat ~/.local/share/openclaw/logs/openclaw.log \
  | jq -r 'select(.level=="error") | "\(.timestamp) \(.message)"' \
  | tail -20

# Count API calls per provider
cat openclaw.log | jq -r 'select(.event=="api_call") | .provider' \
  | sort | uniq -c | sort -rn

# Total tokens used today
TODAY=$(date +%Y-%m-%d)
cat openclaw.log \
  | jq "select(.timestamp | startswith(\"$TODAY\")) | .tokens_used // 0" \
  | awk '{sum += $1} END {print "Total tokens today:", sum}'

# Tail and filter — show errors in real-time
tail -f ~/.local/share/openclaw/logs/openclaw.log | grep --line-buffered "ERROR"

# With JSON format — pretty-print errors as they arrive
tail -f openclaw.log | jq -r 'select(.level == "error") | [.timestamp, .message] | @tsv'

# Alert on repeated errors
tail -f openclaw.log | grep "RateLimitError" | while read -r line; do
  echo "ALERT: $(date) — rate limit hit"
  # Add: send notification, email, etc.
done

# Export last 1000 lines, sanitize API keys, zip for sharing
LOG=~/.local/share/openclaw/logs/openclaw.log
tail -1000 "$LOG" \
  | sed 's/sk-[a-zA-Z0-9-]*/sk-***REDACTED***/g' \
  | gzip > /tmp/openclaw-debug-$(date +%Y%m%d).log.gz
echo "Log exported to /tmp/openclaw-debug-$(date +%Y%m%d).log.gz"

# ~/.openclaw/config.yaml
logging:
  level: INFO          # change to DEBUG only temporarily
  format: json         # json | text (text is human-readable)
  output: file         # file | stdout | both

# Pipe output to logger (add to your start command)
openclaw start 2>&1 | logger -t openclaw -p local0.info

# Or configure in config.yaml
logging:
  output: syslog
  syslog_host: 127.0.0.1
  syslog_port: 514

# Promtail scrape config snippet
scrape_configs:
  - job_name: openclaw
    static_configs:
      - targets: [localhost]
        labels:
          job: openclaw
          __path__: /var/log/openclaw/*.log
    pipeline_stages:
      - json:
          expressions:
            level: level
            msg: message

# /etc/datadog-agent/conf.d/openclaw.d/conf.yaml
logs:
  - type: file
    path: /var/log/openclaw/openclaw.log
    service: openclaw
    source: python
    tags:
      - "env:production"