Agent troubleshooting

Start with these three commands. They answer most questions.

sudo logcore-agent status                          # what the agent is doing right now
sudo logcore-agent configcheck                     # are the config files valid, which files match
sudo journalctl -u logcore-agent -n 100 --no-pager # the agent's own log

On Windows, run the first two in PowerShell as Administrator, and read the log with Get-Content C:\ProgramData\Logcore\logs\agent.log -Tail 100.

Installation

Problem	Fix
LOGCORE_API_KEY is required for a new installation	Copy the full command from Add server. It includes the key.
download failed … /downloads/logcore-agent-…	The server can't reach logcore.lsofito.com, or a proxy blocks it. Test it with curl -I https://logcore.lsofito.com.
checksum mismatch	The download was corrupted or changed by a proxy. Run the command again.
Windows: run PowerShell as Administrator	Open PowerShell with Run as administrator.
Windows: logcore-agent isn't recognized	Open a new terminal so it picks up the updated PATH, or use & "C:\Program Files\Logcore\logcore-agent.exe".

The host doesn't appear

1. sudo logcore-agent status should show Connection: OK.

2. If it shows API key rejected, the key was revoked or mistyped. Re-run the installer with a valid LOGCORE_API_KEY.

3. If you see timeout, connection refused or no such host, allow outbound HTTPS (443) to logcore.lsofito.com in your firewall or security group. If you use a proxy, set HTTPS_PROXY for the service:

   sudo systemctl edit logcore-agent
   # add:
   # [Service]
   # Environment=HTTPS_PROXY=http://proxy.internal:3128
   sudo systemctl restart logcore-agent

4. Make sure you're looking at the right organization in the dashboard. Each key belongs to exactly one organization.

Logs don't appear

Symptom in status	Cause and fix
No Services section	No service files exist yet. Add one to services/. A file ending in .example is ignored.
Service [WAITING]	No file matches. Check the path with ls and make sure it's absolute.
Service [ERROR] permission denied	The agent user can't read the file. Use setfacl, or reinstall with LOGCORE_RUN_AS_ROOT=true. See file permissions.
Files: … 100% but Events: 0 read	Nothing new has been written since the agent started. Existing content isn't imported. Write a test line: echo "test $(date)" | sudo tee -a /var/log/myapp/app.log.
High filtered by rules	Your include or exclude regexes drop the lines. Test them, or remove them for a moment.
Service missing from the list	The file has a YAML error. configcheck shows which one.

Lines arrive in pieces, or stack traces are split

Add a multiline block whose pattern matches the first line of each event.

Wrong severity

Add status.overrides, or set detect: none with a default.

Duplicate lines

A wildcard such as * also matches rotated copies (app.log.1) and compressed files. Use *.log, or add exclude_paths: ["*.gz", "*.[0-9]"].

High CPU or memory

• Very busy files with heavy regexes: simplify your include and exclude patterns.
• Thousands of matching files: narrow your paths, or lower logs.max_open_files.
• Use log_level: debug temporarily to see what the agent is doing, and set it back afterwards.

The status command fails

Message	Fix
permission denied reading the token	Run it with sudo, or as Administrator.
NOT RUNNING (exit code 3)	Start the service: sudo systemctl start logcore-agent, then check journalctl for the reason it stopped.
connection refused on 127.0.0.1:5280	status_addr is "off", or another program uses port 5280. Change agent.status_addr in logcore.yaml.

Still stuck?

Collect the following and send it to your Logcore administrator:

sudo logcore-agent version
sudo logcore-agent status
sudo logcore-agent configcheck
sudo journalctl -u logcore-agent -n 200 --no-pager

Remove the API key from anything you share.