> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-retrieve-the-logs-of-the-enginsight-component-observer.md).

# How can I retrieve the logs of the Enginsight component Observer?

The Observer is an Enginsight component that can be installed on systems in different locations to monitor endpoints externally. In Enginsight, endpoints are internal and external websites and domains.

There are two ways to read the logs of an installed Observer: via the Enginsight platform or directly on the Linux server on which the Observer is installed.

***

## Retrieving Observer Logs via the Platform

Log in to the Enginsight platform and navigate to **Endpoints** → **Required Services** → [Observer](https://docs.enginsight.com/docs/manual/english/platform-usage/endpoints/required-services/observer) to show an overview of all installed Observers.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Get logs** icon <i class="fa-file-lines">:file-lines:</i> at the end of a list item to download the Observer logs as a **txt.gz** file. The icon is grayed out if no log entries are available.

<figure><img src="/files/b7RGmJ0NQOY5O7xwDPkK" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
You can find the exported file in the default download location of your browser.
{% endhint %}

***

## Retrieving Observer Logs Directly on the Server

Depending on the operating system used, different options are available.

### Debian 12 and Later Versions

Starting with Debian 12, system logs are managed via `journalctl` by default. Logs from Enginsight components are therefore no longer written to the classic syslog.

You can show or save Observer logs using one of the following commands:

**Displaying logs**:

```
sudo journalctl -u ngs-observer -n 50
```

**Saving logs**:

```
sudo journalctl -u ngs-observer -n 50 > /tmp/ngs-observer.log
```

{% hint style="info" %}
These commands display or save **the last 50 log entries**. Adjust the number `50` if you want to view more log entries.
{% endhint %}

### Older Debian Versions and CentOS

On older systems, logs are still written to the classic syslog.

You can save Observer logs as a **.txt** file using one of the following commands:

#### Debian

```
cat /var/log/syslog | grep -a observer-m9 > /tmp/<CustomFileName>.txt
```

#### CentOS

```
cat /var/log/messages | grep -a observer-m9 > /tmp/<CustomFileName>.txt
```

{% hint style="info" %}
Remember to replace `<CustomFileName>` with a file name of your choice.
{% endhint %}

***