# Loki on the Pi — compute-asset log aggregation (2026-07-26)

Loki v3.7.4 single binary (arm64) runs on the Pi next to the monitoring stack
(see `../monitoring/README.md`), storing asset logs on the local SSD with
**14-day retention**. Every macOS node ships its service logs here with Grafana
Alloy (per-node config in `infra/<node>/alloy-config.alloy`). The tailed glob is
literally `/var/log/ahel-*.log` + `/tmp/ahel-*.log` — a deployed filename
pattern, not the project's name; see WORKSPACE.md → "Legacy identifiers".

| What | Where |
|---|---|
| HTTP API | `http://192.168.8.240:3100` / `http://100.91.6.75:3100` (Tailscale) |
| Binary | `/usr/local/bin/loki` (GitHub release `loki-linux-arm64.zip`) |
| Config | `/etc/loki/loki.yml` (= `loki.yml` here) |
| Unit | `loki.service` → `/etc/systemd/system/loki.service`, runs as user `loki` |
| Data | `/var/lib/loki` (tsdb index + chunks + compactor + wal) |
| Metrics | `:3100/metrics`, scraped by the local Prometheus (job `loki`) |

Labels: `node` (m1 / m4a / m4b / mac), `job` (`daemon` = /var/log,
`agent` = per-user logs), `filename` (full path, added by Alloy).

## Install / update

```bash
V=3.7.4
curl -fL -o /tmp/loki.zip "https://github.com/grafana/loki/releases/download/v${V}/loki-linux-arm64.zip"
unzip -o /tmp/loki.zip -d /tmp && sudo install -m755 /tmp/loki-linux-arm64 /usr/local/bin/loki
sudo useradd --system --no-create-home --shell /usr/sbin/nologin loki 2>/dev/null || true
sudo mkdir -p /etc/loki /var/lib/loki && sudo chown loki:loki /var/lib/loki
sudo cp loki.yml /etc/loki/loki.yml
sudo cp loki.service /etc/systemd/system/loki.service
sudo systemctl daemon-reload && sudo systemctl enable --now loki
curl -s http://127.0.0.1:3100/ready        # → "ready" (may take ~15s after start)
```

## Query cheatsheet

```bash
# last 10 bifrost lines
curl -sG http://192.168.8.240:3100/loki/api/v1/query_range \
  --data-urlencode 'query={node="m1",filename=~".*bifrost.*"}' --data-urlencode 'limit=10'
# everything from the m4s mentioning "error" in the last hour
curl -sG http://192.168.8.240:3100/loki/api/v1/query_range \
  --data-urlencode 'query={node=~"m4a|m4b"} |= "error"' \
  --data-urlencode "start=$(($(date +%s)-3600))000000000" --data-urlencode 'limit=50'
```

The ahel-gui Monitoring tab has a native Logs section reading this API
(`ahel-gui/lib/loki.js`, endpoint in `config.js` `LOKI`).
