Search logs and analyze application traffic.
ServerChirp reads application logs through the agent. Nginx access and error logs have a structured search view; container and game-server sources expose their raw output.
Depending on the workload, the log explorer can read:
Plain process applications do not expose a separate log source here. Their live output is available through the shared console, and framework worker output is available from the worker view.
For Nginx access and error logs, filter by time range, text, HTTP method, response code or status class, error level, and hostname. Matching results are paginated so a busy production log does not need to be loaded into the browser at once.
Parsed access logs include request path, client address, status, response bytes, referrer, user agent, and timing when the configured format provides it. GeoIP country data appears when the server has matching data available.
Review request totals, bytes served, 2xx/3xx/4xx/5xx distribution, and server-error rate over 24 hours, seven days, or 30 days. The structured log summary identifies top paths, client IPs, user agents, hosts, status classes, and messages for the scanned window.
Use traffic analysis to find a pattern, then return to raw logs for the exact requests. A high 404 count may be harmless scanning; a rising 500 rate after a deployment is usually actionable.
From an Nginx access or error-log result, choose Block to create a UFW deny rule on the application's server. You can block the exact address or widen an IPv4 address to its /24 network or an IPv6 address to its /64 network.
This is a host firewall rule, not a Fail2Ban action. The rule has no port restriction, so it blocks the selected address or network from every port on that server until the rule is removed under Security → Firewall.
Confirm that the logged address is the original client before blocking it. If Nginx is recording a trusted proxy or CDN address, the rule can interrupt traffic for every visitor using that proxy.
Complete access or error logs can be prepared for download. Large log bytes use the private transfer path rather than being embedded in a normal API response.
