super-log-cloud

# super-log

One hub for every log stream you have — devices, servers, containers, browsers, chains and apps.

This project is a consolidation of a patchwork of tools I have used, in one form or another, over the last fifteen years — the log mergers, port watchers, build wrappers, ad-hoc proxies and one-off scripts every long-running bench accumulates — rebuilt here as one coherent thing, on one wire protocol, with one screen.

Free and self-hosted, forever. It collects and consolidates; analysis is a separate, cleaner concern — hand the consolidated stream to super-log.com for real-time LLM analysis and team features, or to your own store. See Collection is not analysis.

Twelve producers on one screen, interleaved by arrival: C++ through both SN_LOG and spdlog, Rust, Go, Python, Swift, Fortran, a POSIX shell script, two React Native devices, Metal GPU work reporting real bandwidth, and a live Binance WebSocket. The last of those is running at hundreds of frames a second — so it is rate-capped, and says so rather than silently dropping them.

If you build across devices, you know the ritual: a Metro console for the iOS simulator, another for the Android emulator, adb logcat for the phone on your desk, a terminal for the C++ engine, another for the Rust service, browser devtools for the web build, and an ssh session to the box in the cloud. Six places to look, none agreeing on timestamps, and the bug is always in the interleaving.

super-log converges all of it on one process and one screen:

 apps, 14+ languages ┐
 GPU and graphics    │
 devices and boards  │                                     ┌─▶ native viewer (ImGui)
 machines, services  ├── POST NDJSON ──▶  superlogd :7333 ─┼─▶ web viewer (React)
 network and DNS     │                    (fan-out+replay) ├─▶ journal → search / replay
 builds and repos    │                                     ├─▶ GET /recent  (scripts)
 blockchain          │                                     ├─▶ MCP tools    (agents)
 anything that prints┘                                     └─▶ alerts → webhook

Group	What is in it
apps	C++ (spdlog sink and nativeSN_LOG), plain C (one header), C# / .NET (BCL only — console, ASP.NET, Unity profiles, Xbox Dev Mode), Rust (tracing), Python (logging), Go (log/slog), Java, Kotlin and Scala (java.util.logging), Swift, Fortran, OCaml, Haskell, Lean 4, Ruby and Rails (a drop-in ::Logger), Perl (core modules only), Lua (5.1+, PUC or LuaJIT), Zig (@cImport of the C header), COBOL (riding the C SDK, yes really), POSIX sh, and JS for Node, the browser and React Native — where console, fetch and WebGL are captured too. Anything else with a C FFI links one object: cc -DSUPERLOG_API= -c impl.c
OpenTelemetry	already instrumented with OTel? Join the bench with no new SDK — point any exporter at 127.0.0.1:4318 (OTEL_EXPORTER_OTLP_ENDPOINT, the standard port, zero config). Logs, metrics and traces over OTLP/JSON and OTLP/protobuf; severityNumber maps to levels, each service.name becomes an otlp.<service> topic, and an OTel span's trace_id becomes the bench's trace — one /recent?trace= returns the OTel spans and the bench's own lines as a single story. And the reverse: superlog-otlp-export feeds any OTLP backend or collector from the bench (OTLP/JSON logs + gauge metrics), so the bench is a two-way OTLP member, not a walled garden
GPU and graphics	Metal and CUDA kernel timings, WebGL context loss and shader failures, and the card itself throughnvidia-smi, rocm-smi or ioreg
devices and boards	iOS and Android over USB, serial consoles reading ESP-IDF, Zephyr and bracketed formats, ROS 2/rosout, and drones over MAVLink (ArduPilot/PX4 — battery, GPS fix, mode/arm, failsafes and the flight controller's own STATUSTEXT, from a UDP stream or a .tlog)
machines, services	OS logs on macOS, Linux and Windows; ~20 known services (postgres, nginx, redis, kafka…); Unity and Unreal Engine editor logs, level-parsed (Blender and AutoCAD by recipe); Docker containers; any remote host over ssh; power draw, thermals and top energy consumers (macOS); crash reports, kernel panics, shutdown causes, volume and sleep/wake events (macOS); filesystem changes down to the changed LINES, diffed in real time; big downloads — a Hugging Face model, shard by shard — with stall alarms; other hubs, bridged whole; and every version under the bench — OS, compilers, runtimes, databases and every package the package manager knows — diffed, so "it worked yesterday" finally has an answer
network and DNS	an HTTP/S logging proxy, WebSocket frames, a syslog and raw TCP/UDP inlet, DNS records with TLS expiry, listening ports with their processes — and the network's ownstate, watched for change: gateway, Wi-Fi, VPN, resolvers, ARP (a gateway MAC change is ERROR — that is how a MITM starts), ping targets with RTT/loss readings and a traceroute attached to every degradation alarm, plus origin-AS watching of your domains' prefixes (what a BGP hijack looks like from outside); the LAN rendered as a tree with any route kept under watch, and the outbound connections this box holds — a socket stuck in SYN-SENT is the filtered/down port a dev loses an afternoon to
builds and repos	cmake, clang, gcc, rustc, swiftc, npm, xcodebuild, Vivado and Quartus — plus sanitizer and valgrind findings captured whole, local git, and GitHub Actions
blockchain	watched addresses on any EVM chain, with transfers decoded and token decimals read per contract; operational key balances with edge-triggered fund-now alarms - EVM (gas or ERC-20), Solana (SOL or SPL), Tron (TRX or TRC-20, USDT included), and Bitcoin (any Esplora API, your own node included)
trading, FIX	FIX session logs (QuickFIX, FIX8, or any engine that writes the standard message log): every message decoded from the SOH-delimited tag=value wire and levelled so the quiet failures shout — a Reject or a rejected fill is ERROR with its reason, a Logout or sequence gap is WARN (the session that stopped filling mid-day), a Heartbeat is DEBUG — with ClOrdID, Symbol, Side, OrderQty, Price and OrdStatus riding as fields; one fix.<begin>-<sender>-<target> topic per session, derived from the message itself, never the filename
anything that prints	your-command 2>&1 | superlog tee — a drop-in tee
alarms, webhooks	rules over the bench (level, rate, silence, combos) plus a tunnelled public webhook for production — deduped by key, repeat-counted, heartbeat dead-man — landing in both viewers' sparse alarm blotters, delivered through one channel registry (desktop, webhook; Telegram/Twilio/email config-gated); public endpoints provisioned one per click or many per manifest file, each with its own ping clock and health light, every route round-trip-tested by the test button, the live URLs written toendpoints.env; webhook testing built in — capture Stripe/GitHub deliveries as wh.* events, verify Stripe signatures on arrival, or relay each delivery to your local handler with its real response returned (stripe listen, with a record)

Every producer speaks one small wire protocol (docs/PROTOCOL.md: one JSON event per line, batched over plain HTTP POST), the hub fans out to any number of readers with replay-on-connect, and everything is interleaved by hub sequence — not by device clocks, which drift.

Quick start

macOS — Homebrew:

brew install saxonnicholls/tap/super-log && brew services start super-log

Ubuntu (incl. Ubuntu Server on a Pi) — the PPA, every architecture, auto-updating:

sudo add-apt-repository ppa:super-log/stable && sudo apt update && sudo apt install super-log

Debian / Raspberry Pi OS — the .deb directly (PPAs are Ubuntu-only; don't use add-apt-repository here). Pick your arch:

curl -fsSL -O https://github.com/saxonnicholls/super-log/releases/download/v0.4.0/super-log_0.4.0_arm64.deb   # or _amd64.deb
sudo apt install -y ./super-log_0.4.0_arm64.deb

Then see it work in two lines — the hub is already running on :7333:

echo "the bench is live" | superlog tee --topic hello
curl -s "http://127.0.0.1:7333/recent?topic=hello"

Fedora/RHEL, npm, vcpkg, building from source, and the web + native viewers are in Install below.

The superlog CLI

One command reads the bench, manages the tailers, and pipes streams onto the hub:

superlog status            what's running, and the hub's health
superlog alarms            firing alarms   (every read command is NDJSON when piped — | jq)
superlog versions          the version inventory, per host
superlog start vitals      start a tailer in the background
superlog stop vitals       stop it
superlog viewer            open the native viewer  (builds it once if needed)
superlog tee               a stream onto the hub   (make 2>&1 | superlog tee --topic build)
superlog login             open super-log Cloud in your browser

Full reference: docs/CLI.md. Or superlog help.

What it does for you

One screen, everything on it. Streams colour-coded by source and level, filtered by stream, minimum level or substring. Pause freezes the display while collection continues; copy a row or the whole filtered view; export JSON, CSV or plain text.

The minimum level set to ERROR: 29 rows out of 1131. The same pricing failure surfaces from Swift, Python, Go and a shell script side by side — each in its own language's idiom, a PricingError, a KeyError, a returned error, a shell test — plus the GPU refusing an allocation four times the size of the card. Python's row carries the local variables from the failing frame, which is the part you would otherwise be adding a print statement to find.

Your apps need almost nothing. Fourteen dependency-free SDKs: header-only C++ (both a spdlog sink and a native snicholls::log one), plain C in one stb-style header — zero-alloc, and a production build provably contains no logging at all — a Rust crate with an optional tracing layer, Python plugging into stdlib logging, Go with a log/slog handler, Java with a java.util.logging bridge (Kotlin and Scala ride it, one import, zero glue), Swift, Fortran over raw POSIX sockets, OCaml over the same raw sockets, Haskell needing only GHC's boot libraries and curl, Lean 4 for the proof jobs that run all night (core IO plus curl — Lean grew a kernel before it grew sockets), Perl from core modules alone (HTTP::Tiny has shipped with Perl since 5.14), Lua making the same curl bargain as the shell SDK (Lua never grew sockets at all), C# from the BCL alone — everywhere .NET goes, including Unity profiles and Xbox Dev Mode — Zig through @cImport of the C header itself, COBOL through a 20-line C shim onto the header-only C SDK, Ruby from the stdlib — with a drop-in ::Logger adapter, which makes the whole Rails story one config.logger assignment — a sh one-liner for scripts, and one JS client for React Native, the browser and Node — patchConsole: true and every console.log is on the bench.

Six of them hook the logging framework the language already has — the spdlog sink, logging.Handler, slog.Handler, java.util.logging.Handler, Ruby's ::Logger adapter and patchConsole — so everything a program already logs reaches the bench without a single call site changing.

Why the interleaving is the point. In the middle, one Swift tick unfolds in order — the tick at INFO, a DEBUG pricing pass, the ERROR its exception raised, and the WARN that followed — while eleven other producers keep writing around it. Reconstructing that sequence from separate terminals is the ritual this replaces.

Follow one action across every tier. A tap becomes a request, a database write and a chain call on four streams. withTrace() mints a correlation id, carries it across awaits, and puts it on outbound HTTP automatically; a server adopts it and logs under the same id. Then one query — a ⇢ in the viewer, GET /recent?trace=…, or an agent tool — returns the whole story in order.

Every error, including the ones nobody logged. Uncaught exceptions and unhandled rejections are captured by default in every SDK, with whole stacks — not clipped to the throw site, because a deep React Native render error runs 100+ frames through the bridge and that path is the thing you actually need to paste. Capture chains to whatever was already installed, so React Native still shows its red box, Node still exits 1, and C++ still aborts. C++ traces are demangled (pricer::Engine::quote(int)) with no boost dependency. For the hardest class — an exception a library throws and a component boundary catches and displays, so it never reaches the global handler — wrap the tree in SuperLogErrorBoundary (or forward your own boundary's componentDidCatch to log.exception): that lands the component stack too, the one thing a JS stack never contains — it names the component that threw. Plus an opt-in breadcrumb on every Error construction.

Zero-app-change fallbacks. Host-side tailers scrape what already exists: adb logcat (scoped to one app, because an OEM handset emits ~600 lines a second), the iOS simulator's log stream, the macOS unified log, journald, Docker containers, and any log file. A catalog knows where ~20 common services log on macOS and Linux — postgres, mysql, mongodb, redis, nginx, apache, kafka, elasticsearch, rocksdb — including both Homebrew prefixes. The catalog also knows the engines and content tools: Unity's Editor.log (the C# compiler's error CS1234 becomes ERROR, a thrown exception too, while a folder named "Exceptions" stays INFO) and Unreal Engine's per-project editor logs (LogNet: Warning: maps by Unreal's own verbosity words, category kept). Blender logs to stdout — that is what the tee is for — and AutoCAD's LOGFILEMODE file tails like any other.

Whole fleets, pulled over ssh. One config file brings up every stream on every server: OS logs, service logs, container logs. Nothing is installed remotely, no port is opened, and the servers never need to reach the hub — so the hub can stay loopback-bound while still watching production.

HTTP calls, request and response. Front a service with the logging proxy and every call is one event (method, path, status, latency, size), or turn on patchNetwork in the app and see the calls it makes. HTTPS targets need no certificate work. Bodies are opt-in; credentials are always redacted.

Blockchain addresses, beside the code that touched them. Watch any EVM address and its transfers, contract events and native balance moves land on the same screen, in hub order, next to the app code that sent them.

Operational keys that never silently run dry. A keeper or oracle out of gas stops a production system as surely as a crashed server, and it fails politely — it just stops, and nothing says why. superlog-gas polls the balances you name (native coin or ERC-20, per chain, per key, from a gitignored config — a labelled key list is a map for an attacker) and applies the bench's discipline: readings are metric events for the chart, crossing your fund-now line is CRITICAL said once, your low line WARN once, and refunding is announced. One JSON-RPC batch per chain per poll, because a public RPC's rate limit is part of the design surface.

Infrastructure that only speaks when something changes. DNS records and TLS expiry, listening ports and the processes that own them — all watched by diffing snapshots, so the stream is silent until it matters: an NS record you did not change, a certificate three weeks out, a new public listener on a production box, a service that restarted without saying so.

Builds as events, not walls of text. Wrap any build — cmake, clang, gcc, cargo, npm, xcodebuild, local or over ssh — and compiler diagnostics become WARN/ERROR rows with file:line, with one summary event carrying exit status, duration and counts. Linking included: GNU ld's undefined reference and multiple definition carry no severity word and would otherwise scroll past as INFO; they, Apple's Undefined symbols and duplicate symbol, lld, collect2, and the driver's own clang: error: linker command failed all land as ERROR. Debuggers ride the same rails: pipe a batch session through the tee — gdb --batch -ex run -ex bt ./app 2>&1 | superlog tee --topic dbg.app --classify (lldb likewise) — or tail gdb's set logging file like any other.

Massive downloads, watched. A 70B model from Hugging Face is fifteen shards and half a day of \r-rewritten progress bars that exist only on the terminal that started them — and tqdm, curl and wget all mute or reshape those bars the moment their output is a pipe, so tee sees nothing. Wrap the fetch in superlog-dl and percent, bytes and rate become metric events; or point --watch at the destination directory and progress is measured at the filesystem, which no tool can mute and which is the only honest aggregate when every shard resets its own bar. The event that matters most is the stall: no bytes for 30 seconds is a WARN on the bench — hours before the fetch's own patience runs out at 97% of 140GB.