You can search, view, stream, and download logs from enrolled devices in the Flight Control web console without SSH access to the device.

Log data is retrieved over the existing gRPC connection between the Red Hat Edge Manager agent and the Red Hat Edge Manager service, so operators on a different network than the device can troubleshoot when the device is reachable only through the management plane.

When to use console log access

Use the Logs view on a device when you need to inspect agent or system journal output, or files under /var/log, during Day 2 operations, for example:

• Verifying that the agent applied a configuration change
• Following activity during an OS update or application deployment
• Reading a log file under /var/log when the output you need is not in the journal
• Collecting recent log lines to share with your team before opening a support case

How log access uses the agent connection

The web console does not open a new inbound port on the edge device. Requests to retrieve, view, stream, and download logs use a device console session. This session runs over the agent’s outbound gRPC connection to the Red Hat Edge Manager service. The agent runs commands on the device as the flightctl-console user to retrieve and stream log output through that session, similar to other agent-mediated operations.

Plan firewall rules so that enrolled devices can reach the agent API endpoint. For port numbers and deployment context, see Network ports for Red Hat Edge Manager and Red Hat Edge Manager API server in the Additional resources section.