Log Sources & Input Protocols

Complete technical specification for reading Caddy v2 access logs

1. Local Log Files & Path Globs

Read directly from local JSON access log files on disk. If positional source arguments are omitted, caddy-analyze automatically checks for local log files in ./access.log, ./caddy.log, or /var/log/caddy/access.log:

# Single access log file
caddy-analyze /var/log/caddy/access.log

# Multiple files using wildcard globs
caddy-analyze /var/log/caddy/*.log

# Auto-discovery mode (runs against default local log paths)
caddy-analyze

2. Standard Input Pipe (-)

Use - to pipe structured log content from standard input. This enables seamless integration with unix utilities like cat, zcat, grep, or remote SSH streams:

# Read compressed gzipped log archives
zcat /var/log/caddy/access.log*.gz | caddy-analyze -

# Read remote logs via SSH tunnel
ssh user@remote-server "cat /var/log/caddy/access.log" | caddy-analyze -

3. Docker Containers (docker://)

Stream JSON logs directly from the Docker daemon socket using container names or container IDs:

# Read logs from a running Docker container
caddy-analyze docker://my-caddy-container

# Real-time log tailing from Docker
caddy-analyze tail docker://my-caddy-container

Note: Requires permissions to access /var/run/docker.sock. Add your user to the docker group if permission is denied.

4. Kubernetes Pods (k8s://)

Connects directly to Kubernetes pods using your active kubectl context configuration:

# Read logs from pod in default namespace
caddy-analyze k8s://caddy-pod-abc12

# Specify namespace using -n or --namespace flag
caddy-analyze k8s://caddy-pod-abc12 -n production

5. Systemd Journalctl (journalctl://)

Reads log streams directly from the systemd journal for Caddy service units:

# Read systemd unit journal
caddy-analyze journalctl://caddy.service

6. Handling Permission Denied Errors

When Caddy log files are owned by root or caddy:caddy with restricted 0600 permissions, caddy-analyze outputs a helpful diagnostic hint:

error: permission denied reading /var/log/caddy/access.log
💡 Hint: Run with sudo: sudo caddy-analyze /var/log/caddy/access.log
💡 Or add your user to the caddy group: sudo usermod -aG caddy $USER