v0.9.3

Trawl 0.9.3

Trawl collects and searches logs for homelabs and small installations. Run one
Linux server, send it events over HTTP or syslog, and search them from a browser,
the command line, or the terminal UI.

This release makes trawld's request limit a real limit, and it fixes service
names that the shipped Vector configurations sent and trawld refused.

What is included

• [server] max_concurrent_requests counts the HTTP requests in progress
  across the whole listener. The count covers every route and method, and a
  request keeps it until the ingest or preview work that holds its body ends.
  When the count is full, trawld refuses the next request at once with a 503
  request_limit_reached and no Retry-After. The setting takes 1 to 65536,
  and the default is 32.
• Two fixed allowances sit beside the count: 3 requests for health and
  metrics, and 4 for listing and cancelling queries. They do not borrow from
  the count or from each other, so a full server still answers its probes.
  trawl_http_requests_refused_total{allowance} counts the refusals.
• fleet-auth runs at most four argon2 checks at once, which bounds the memory
  that token checks can use.
• The Helm chart adds the TrawlIngestEventsRejected alert. It fires when
  trawld refuses events for a reason that a sender which reads only status
  codes, such as Vector, does not see.

Fixes

• The shipped Vector configurations send only service names that trawld
  accepts. A journal entry takes its name from the systemd unit, cut at the
  template @, then from the syslog identifier, then from the command. For
  example, postgresql@17-main.service becomes postgresql. Before this
  fix, trawld refused templated unit names and stored none of those events.
  A name that no field can supply goes to a marked fallback, such as
  journal-unidentified, instead of unknown.
• The base.toml catch-all no longer walks /var/log/trawl, which Vector
  cannot read, so Vector stops logging a glob error on every scan.
• trawld keeps serving after an error from accepting a connection, such as
  running out of file descriptors.
• trawld --doctor reads a request_limit_reached health answer as a
  capacity refusal. trawl-web passes a non-2xx answer to a stream request
  through unchanged.
• The Helm chart prints its ingress TLS note only when an ingress is
  configured.
• The Debian and Helm guides install fleet-admin before the schema step
  runs it, build the database Secrets from owner-only files, and say where
  the reverse proxy's certificate comes from.

Existing installations

0.9.3 keeps the 0.9.0 storage epoch and database baseline. The server applies
forward migrations at startup.

The default request limit drops from 256 to 32, and the setting now bounds the
whole server instead of each route. If you set max_concurrent_requests,
check the value against what the server should run at once. trawld refuses to
start on 0 or on a value above 65536. Run trawld --check-config first.

If you copied the Vector configurations from the Debian package, copy them
again from /usr/share/doc/trawl-server/examples/vector/. Service names for
templated units now lose their instance, and the unknown, varlog and
docker fallbacks become journal-unidentified, varlog-unidentified and
docker-unidentified. Update saved searches that match the old names.

Installation choices

Platform	Available components
Linux amd64 and arm64	Server and CLI archives, Debian packages, and container images
macOS 15 or newer, Apple silicon and Intel	CLI archives
Kubernetes	Helm chart for the Linux server and browser

Linux packages target Debian 12. Archives include the DuckDB runtime; keep
their bin/ and lib/trawl/ directories together. macOS archives use ad-hoc
signatures and are not Apple Developer ID signed or notarized.

Start with the installation guide and
your first query.

Requirements and scope

A server needs persistent storage and PostgreSQL, with separate databases for
authentication and application state. Clients need an API key with the required
permissions and trust in the server's TLS certificate. The browser requires
its own public origin and persistent session key.

Trawl is designed for one node. It does not provide clustering, sharding, or
multi-tenancy. Storage and memory needs depend on ingest volume, retention,
and queries.