Seq Documentation and Support

Seq Documentation and Support

Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    
Ask A Question



Slack plugin for dashboad alerts

Hello Nicholas, I'd like to describe you a use case, perceived problems and possible work around in order to get feedback from you and hopefully future improvements from seq. With the new dashboards / alerts one understandably might wants to send the alerts to Slack. We do have a [plugin for Slack]( already, but it was written in pre-dashboard era. In particular, this plugin always assumes to be associated with an event and displays [(View on Seq)]( link that is not possible to switch off. Alerts are often not associated with any particular event so you have a link that leads to a error page instead. This is in itself is not a very huge problem and is easily corrected within the plugin code. Another issue is a bit bigger. With dashboard graph, one might want to see the graphs _in slack_. Of course a link to dashboard could be added via `MessageTemplate` option of the Slack Plugin, but in my use case these links are internal and people would like to make sense of their Seq alerts externally in Slack application. When one is not logged in to their corporate network on their phone and get the Slack message Seq alert the links won't work as the Seq instance is not exposed externally from security, infrastructure and architecture reasons. There is [a question]( related to it and there is a [relevant github issue](, but I would like to explore this topic a bit further. **Access to rendered dashboard images** It would be nice if one could use the API or at least HTTP request to be able to get a dashboard image. Currently this is impossible, and having read your response to the question linked above I'm not holding my breath. I was successful in scraping the images with [phantomjs](, [svg-crowbar](, [selenium](, phantomjs web driver, [](, and a lot of duct tape. Yet, an "official" way of doing this would be nice. A big problem of the scraping approach, that Seq can help with (relatively easily) is authentication. In order to scrape you need to log-in. In order to login you need to provide credentials. Currently it's not possible to get the charts with an API key at all but it is on the list of improvements listed above, so I'm hopeful. Scraping is liable to break when layout of the html page changes. It is quite fragile, and easy to break. If it is difficult to provide exportable images, maybe it would be easier to document html markers that could be used to scrape the dashboard page for each image. That will give some assurance that scraping won't break with the next Seq version. **Credential management for access to the images** The next thing is providing either credentials or API key to the plugin. This can be done via plugin configuration UI, but it feels very lame. The plugin configuration UI looks and feels as part of SEQ, and it feels very weird that I need to key it the API key on that page or worse my user name and password. Currently one would have to resort to the latter. To be clear: I'm talking about hypothetical slack plugin that would fetch images from the dashboard and need credentials to do so. As it is now, I *have* to key in a user account and a user password. Since user management somewhat lacking in seq (we only have the Administrator flag, no groups or permissions) it means that every administrator will have access to this configuration page. In an actual organisation I'd like to give some permission (like create a new API key) to certain people (who are now given admin rights) but I certainly do not want these people to have access to my service account credentials. Currently it seems unavoidable. In addition this service account consumes 1 user in my license entitlement and it does not feel good at all. Maybe a better permission system can be added? Similar, to say Octopus? All in all I feel like there is a room for improvement here, but because of the next section, if it does not get implemented it is still workable. **Plugin-level access to Seq** What I really would like to see is that plugin having access to the Seq API _and_ being able to scrape without logging in. We could assume that people installing the plugin have enough authorization to access the system, so that the plugin can do it on their behalf. Certainly access to API would be expected, but because API does not give us the chart images and the HTTP requests do, also access to the website from within the plugin. **Current state** A slack plugin posting dashboard image is workable: - Plugin collects user credentials - Plugin scrapes the page using the credentials - Plugin converts/posts the image on slack Disadvantages of this approach: - Credentials not stored securely - Scraping is awkward to perform - Scraping depends a lot on the html generated which is likely to change between version and break the plugin. **Minimal Changes** - Mark images in the html so the scraping can survive version upgrade reliably - Make dashboard available with an API key without need to log in - Make plugins automatically using appropriate API key without need to configure one in the interface for access to the dashboard. **Longer Term** - Better permissions system - Plugin access to API - Charts accessible via API - that would be ideal - Protected fields for plugin configuration for holding sensitive information - Service accounts not to consume user license Please, your thoughts?

Posted by Andrew Savinykh 24 days ago


Raw events not always logged

I am calling into seq from a ssis package using the raw posts. Quite often those calls do not get through. The post call just takes a very long time and eventually imes out. Even retries fail. Messages I am posting are quite small. Allowing buffered writes feels like it's helpped but I am just not getting through consistently. I am also experiencing same issues in multiple environments so it is related to a particular instance Is there anything else I could try? The code is c# : using System; using System.Collections.Generic; using System.Data.SqlClient; using System.Linq; using System.Text; using System.Web.Script.Serialization; namespace Seq { public class SeqProxy { private readonly string rawUrl; public SeqProxy(string url) { rawUrl = url; } public void LogEvent(LogLevel level, string correlationId, string messageTemplate, Exception exception, Dictionary<string, object> properties) { var re = new RawEvents { Events = new[] { new RawEvent { Level = level.Name, Timestamp = GetJsonDate(), MessageTemplate = messageTemplate, Exception = exception==null ? "" : exception.ToLogString(), Properties = properties.Union(new Dictionary<string, object> { {"CorrelationId", correlationId}}).ToDictionary(x=>x.Key,x=>x.Value) } } }; var m = new JavaScriptSerializer().Serialize(re); try { HttpPost(rawUrl, m); } catch (Exception) { //retry try { HttpPost(rawUrl, m); } catch (System.Exception) { //Ignore seq failure - ocasionally seq fails with timeout. Retry should normally fix it but if it doesn't we don't need to fall over because of it. } } } private static string GetJsonDate() { var dt = DateTime.UtcNow; TimeZoneInfo localZone = TimeZoneInfo.Local; return String.Format("{0}-{1}-{2}T{3}:{4}:{5}.{6}{7}{8}{9}", dt.Year, dt.Month.ToDatePart(), dt.Day.ToDatePart(), dt.Hour.ToDatePart(), dt.Minute.ToDatePart(), dt.Second.ToDatePart(), dt.Millisecond, (localZone.BaseUtcOffset >= TimeSpan.Zero) ? "+" : "-", Math.Abs(localZone.BaseUtcOffset.Hours), Math.Abs(localZone.BaseUtcOffset.Minutes)); } private static void HttpPost(string url, string message) { System.Net.WebRequest req = System.Net.WebRequest.Create(url); req.ContentType = "application/json"; req.Method = "POST"; req.Timeout = 120000; byte[] bytes = System.Text.Encoding.UTF8.GetBytes(message); req.ContentLength = bytes.Length; using (System.IO.Stream os = req.GetRequestStream()) { os.Write(bytes, 0, bytes.Length); os.Close(); } System.Net.WebResponse resp = req.GetResponse(); } } public class LogLevel { public string Name { get; private set; } public static LogLevel Verbose { get { return new LogLevel { Name = "Verbose" }; } } public static LogLevel Debug { get { return new LogLevel { Name = "Debug" }; } } public static LogLevel Information { get { return new LogLevel { Name = "Information" }; } } public static LogLevel Warning { get { return new LogLevel { Name = "Warning" }; } } public static LogLevel Error { get { return new LogLevel { Name = "Error" }; } } public static LogLevel Fatal { get { return new LogLevel { Name = "Fatal" }; } } } public class RawEvents { public RawEvent[] Events { get; set; } } public class RawEvent { public string Timestamp { get; set; } // Uses the Serilog level names public string Level { get; set; } public string MessageTemplate { get; set; } public Dictionary<string, object> Properties { get; set; } public string Exception { get; set; } } public static class SeqExtensions { public static string ToDatePart(this int part) { return part.ToString().PadLeft(2, '0'); } public static string ToLogString(this Exception exception) { var sb = new StringBuilder(); sb.Append(Environment.NewLine); sb.Append("Error Details: " + Environment.NewLine); sb.Append("Source: " + exception.Source + Environment.NewLine); sb.Append("Message: " + exception.Message + Environment.NewLine); sb.Append("StackTrace: " + exception.StackTrace + Environment.NewLine); sb.Append(GetInnerExceptionsAsString(exception)); return sb.ToString(); } private static string GetInnerExceptionsAsString(Exception ex) { if (ex is SqlException) { return SQLErrorToString(ex); } else { return InnerExceptionToString(ex); } } private static string InnerExceptionToString(Exception ex) { var sb = new StringBuilder(); bool b = true; string newLine = Environment.NewLine; while (b) { ex = ex.InnerException; if (ex != null) { sb.Append(newLine); sb.Append("Inner Error: " + newLine); sb.Append("\tSource: " + ex.Source + newLine); sb.Append("\tMessage: " + ex.Message + newLine); sb.Append("\tStackTrace: " + ex.StackTrace + newLine); } else { b = false; } } return sb.ToString(); } private static string SQLErrorToString(Exception ex) { var sb = new StringBuilder(); string newLine = Environment.NewLine; foreach (SqlError err in ((SqlException)ex).Errors) { sb.Append(newLine); sb.Append("SQL Error: " + newLine); sb.Append("\tMessage: " + err.Message + newLine); sb.Append("\tLineNumber: " + err.LineNumber + newLine); sb.Append("\tNumber: " + err.Number + newLine); sb.Append("\tProcedure: " + err.Procedure + newLine); sb.Append("\tServer: " + err.Server + newLine); } return sb.ToString(); } } }

Posted by Zak about a month ago


We are experiencing unavailablity issues in the Web UI

After aprox. 20 hours of running, we are not being able to reach the Web UI (even from the same server that seems to work correctly during the down times). It site comes and goes but it is mostly unavailable until we restart the SEQ windows service. We reviewed the logs in the storage folder and saw no errors or warnings indicating any performance drop or issue. It worth mention that while the UI is unavailable the SEQ process is consuming arround 45 GB of 56 available (systemRamTarget is set to 0.9) Can you help us to troubleshoot this issue? addtitionnlay since we updated to the latest version the logs seem to be in a different format: before: 2017-10-03 00:07:07.635 +00:00 [Information] Retrieval of StorageRange { RangeStartUtc: null, RangeEndUtc: null, IsRelevantEventTypeHash: null, Direction: Backward, StartFromKey: null, ..... after: {"@t":"2017-10-11T00:15:24.5717232Z","@mt":"Deduplication buffer renewed on reaching {@Shared}","Shared":{"Schemata":361,"Strings":213050},"SourceContext":"Flare.Events.Cache.SegmentCache", .... do we need to configure anything to have the logs formated as before (version 3.4.20) Here is the summary for the diagnostic report (after 9 hours of running) ==================== 1. Executable -------------------- Seq Version : 4.1.17 Bitness : 64 Framework Version : 4.0.30319.42000 ==================== 2. Operating System -------------------- OS Caption : Microsoft Windows Server 2012 R2 Datacenter OS Version : 6.3.9600 OS Bitness : 64 ==================== 3. Processor #1 -------------------- Description : Intel64 Family 6 Model 45 Stepping 7 Cores : 8 ==================== 4. Error -------------------- Diagnostic reporter Seq.Server.Features.Diagnostics.ProcessorReporter failed. System.Management.ManagementException: Not found at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode) at System.Management.PropertyDataCollection.get_Item(String propertyName) at System.Management.ManagementBaseObject.GetPropertyValue(String propertyName) at Seq.Server.Features.Diagnostics.Wmi.Processor.get_IsNumberOfEnabledCoreNull() at Seq.Server.Features.Diagnostics.ProcessorReporter.Report(DiagnosticReport report) at Flare.Diagnostics.Reporting.DiagnosticReportCollector.CollectDiagnosticReport(TextWriter output) ==================== 5. System Memory -------------------- Physical Total : 60129071104 Physical Available : 15745794048 Physical Utilization: 0.73813342267061 Commit Limit : 174610165760 Commit Peak : 121895325696 Commit Total : 44744867840 Process Count : 52 Handle Count : 43589 Thread Count : 985 Kernel Total : 1585152000 Kernel Paged : 186847232 Kernel Non-paged : 1398304768 Page Size : 4096 System Cache : 15859699712 ==================== 6. Process Memory -------------------- Working Set (Environment): 4113080320 Working Set : 38472822784 Paged : 38470361088 Paged System : 832224 Non-paged System : 21283839 Private : 38470361088 Handle Count : 23401 Thread Count : 259 ==================== 7. Process -------------------- Uptime : 09:09:34.1042925 Thread Pool Threads Available: 32761 Thread Pool IOCP Threads Available: 969 ==================== 8. System Storage -------------------- Space Remaining : 2311537541120 ==================== 9. Event Storage -------------------- First Extent Range Start: 2015-09-02T00:00:00.0000000Z Last Extent Range End: 2017-10-18T00:00:00.0000000Z ==================== 10. Event RAM Cache -------------------- Days Cached : 5.25 Events Cached : 12093304 Is Warming Up : Yes ==================== 11. Configuration -------------------- Preferred Storage Engine: <null> LMDB Extent Map Size: 200000000000 System Memory Utilization Target: 0.9 Minimum Free Disk Space: 134217728 Lazy Flush Enabled : No Raw Event Maximium Content Length: 262144 Raw Payload Maximum Content Length: 1048576 API Keys Required : Yes Authentication Enabled: Yes Active Directory Authentication: No Azure Active Directory Authentication: No

Posted by Pablo about a month ago