Skip to main content

Troubleshooting

401 Unauthorized on every request​

An API key is configured (LOG_LENS_TOKEN / auth.token) and the request didn't present it. Send X-Log-Lens-Token: <token> or Authorization: Bearer <token>. In the dashboard, use the header key button to enter/change it. See Security.

403 Cross-origin request blocked​

A state-changing request arrived with an Origin whose host ≠ the request host. Make the SPA and API same-origin, or (for non-browser clients) omit the Origin header. This is the CSRF guard, working as intended.

419 on writes (in Laravel)​

This is handled automatically now: the dashboard reads Laravel's XSRF-TOKEN cookie and sends it as the X-XSRF-TOKEN header, so writes pass the web middleware CSRF check. If you still see a 419, make sure the routes keep the web middleware group in config/log-lens.php (it's what issues the XSRF-TOKEN cookie), and that cookies aren't stripped by a proxy.

An unauthenticated / incognito tab can open the dashboard (Laravel)​

Expected in the local environment with no gate configured (the default is local-open). Register LogLens::auth(fn ($r) => $r->user() !== null) to require login even locally. See Laravel Package.

Blank page / 503 "UI has not been built"​

The frontend build is missing. Standalone: cd frontend && npm ci && npm run build ( to packages/core/public/ui). Laravel: npm run build:laravel then php artisan vendor:publish --tag=log-lens-assets.

Dashboard loads but assets 404 (Laravel)​

Assets weren't published, or were rebuilt without re-publishing. Run php artisan vendor:publish --tag=log-lens-assets --force. They must live at public/vendor/log-lens/assets/.

"The archived source file is unavailable" on raw fetch​

The processed/ file backing that occurrence was removed (e.g. by retention). The indexed issue and counts are intact; only the raw body is gone. Re-import the file if you need the raw evidence.

No issues after importing​

Only severities on the workspace allowlist are indexed (default ERROR + WARNING). Enable more under Settings to Ingestion, then reindex. Also confirm the file matched ingestion.log_file_pattern.

Timestamps look wrong / everything on one day​

The parser couldn't read the event's timestamp and fell back to import time. Check the log format matches a supported format; for custom formats, the generic console parser needs a bracketed or ISO timestamp.

"database is locked" / duplicate-column on first request after upgrade​

Fixed: migrations are serialized with an immediate write lock and gated by PRAGMA user_version, and busy_timeout is set before the WAL switch. If you somehow still hit it, ensure only one process performs the very first initialization, or raise database.busy_timeout.

Moved the folder and paths broke​

They self-heal: SourcePathRepairService re-points stored paths on the next request by matching file size. If a file's size changed while moving, re-import it.