Session Logs

Session Logs

COI records operational messages from each shell session to log files on the host. The coi logs command reads those files, making it easy to review what happened in a session after it ends or to tail output in real time.

Note: Session logs contain COI's own setup and housekeeping messages — things like "Setting up claude config…" or network-refresh notices. They are distinct from security audit events, which are written to ~/.coi/audit/<container>.jsonl and accessed via coi audit.

Log File Locations

File	Contents
~/.coi/logs/<container>.stdout.log	Informational messages (setup steps, status updates)
~/.coi/logs/<container>.stderr.log	Warnings and errors

Both files are appended to across resume cycles, so a single container name accumulates logs from all of its sessions.

Usage

# Print logs for the container associated with the current workspace
coi logs

# Print logs for a specific container
coi logs coi-abc123-1

# Tail logs in real time (both files, Ctrl+C to stop)
coi logs coi-abc123-1 --follow
coi logs coi-abc123-1 -f

Auto-Detection

When no container name is given, coi logs resolves the container the same way coi monitor does — from the current workspace directory. If multiple containers are running, pass the container name explicitly.

Output Format

Stdout log lines are printed as-is. Stderr log lines are prefixed with [ERR] so they are visually distinct even when both streams are interleaved:

2026/05/22 10:15:01 [setup] Setting up claude config...
2026/05/22 10:15:01 [setup] Container setup complete!
[ERR] 2026/05/22 10:15:03 [network] allowlist refresh failed: dial tcp: lookup example.com: no such host

Follow Mode

With --follow, coi logs seeks to the end of both log files and polls for new content every 200 ms until you press Ctrl+C. If a log file does not exist yet (e.g. the session is still starting), coi logs --follow retries until it appears.

# In one terminal: start a session
coi shell

# In another terminal: watch its logs live
coi logs --follow

Related Background Logs

Some subsystems write their own log files that are not included in coi logs:

File	Written by
~/.coi/logs/network-refresh-<container>.log	Background allowlist IP-refresh goroutine (when network.mode = "allowlist")

These files can be read directly with cat or tail -f.

See Also

• Security Monitoring — threat-event audit logs and coi audit
• Network Isolation — allowlist mode and the refresh background task
• Container Lifecycle and Sessions — session resume and cleanup