pixop-logs

Read-only, sanitized LIVE and TSDuck log browser for diagnostic Pixop support SSH sessions. Output is redacted stdout only—pipe to grep, less, or similar in your shell.

Availability: Requires an active pixop-support-access grant at diagnostic level (or admin, which includes broader access). Confirm with command -v pixop-logs and pixop-logs -h. Installed path when present: /opt/pixop/bin/pixop-logs.

This tool is for the unprivileged pixop-support account during a grant. It is not a replacement for pixop-pack-logs or pixop-support-bundle on ec2-user.

Usage

pixop-logs --list
pixop-logs <selector> [--lines N] [--include-rotated]
pixop-logs <selector> -f|--follow [--lines N]
pixop-logs -h|--help

Selectors match log basenames under /var/log/pixop-live (for example live, tsduck-in-main, tsduck-out-egress-main). Invalid selectors fail closed.

Examples

pixop-logs --list
pixop-logs live --follow
pixop-logs tsduck-in-main -f
pixop-logs live | grep -i error
pixop-logs live --lines 1000 | less
pixop-logs live -f | grep --line-buffered -i error

How it works

pixop-logs runs as the support user and invokes sudo -n /opt/pixop/bin/pixop-support-diagnostics (fixed allowlist only). The helper enforces:

• Fixed log root under /var/log/pixop-live (no arbitrary paths)
• Root-owned regular files only (symlinks and unsafe paths refused)
• Bounded line counts and scan windows; oversized lines suppressed
• Sanitization before stdout (same family of rules as other diagnostic helpers)

If sudo returns 124, the diagnostic grant may be inactive or password would be required. If listing or tail fails, confirm pixop-support-access status shows an active grant at diagnostic (or admin) level.

Equivalent direct helper (same redaction rules; root-only):

sudo -n /opt/pixop/bin/pixop-support-diagnostics logs list
sudo -n /opt/pixop/bin/pixop-support-diagnostics logs tail live --lines 500
sudo -n /opt/pixop/bin/pixop-support-diagnostics logs follow live --lines 30

Other diagnostic subcommands (status, logs-live, config, …) remain on the allowlisted helper surface documented in pixop-support-access.

Limitations and risks

• Sanitization is best-effort: secrets embedded in unstructured log text may survive; treat output as confidential until reviewed.
• --follow does not combine with --include-rotated.
• Rotated snapshots and gzip history are bounded; very old lines may be truncated with an explicit marker.
• Log files on disk may contain more data than the browser shows; do not assume stdout equals full live.log.

Related

• pixop-support-access — grant, revoke, and access levels
• Licensing and support
• Monitoring and troubleshooting