Papertrail

Papertrail (by SolarWinds) provides traditional log aggregation — collect logs from servers, applications, and services via syslog protocol, then search and alert on them. For agents, Papertrail's value is in log search and alerting rather than programmatic log ingestion. The primary ingestion method is syslog (UDP/TCP) — applications send logs using standard syslog libraries. The Search API enables programmatic log querying. Alerts trigger on log patterns and notify via email, Slack, PagerDuty, or webhook. Archive sends logs to S3 for long-term storage. For agents already using syslog-based logging, Papertrail adds search and alerting without changing the logging pipeline. The limitation: the syslog-first model is less agent-friendly than HTTP-based ingestion APIs (Axiom, Datadog) for applications that don't use syslog natively.

API token authentication via X-Papertrail-Token header. Token is generated in account settings. Single token per account with full API access. No fine-grained scoping. No OAuth. Token doesn't expire. For agents, the auth model is the simplest possible — one token, all access. Log ingestion authentication uses syslog credentials (destination hostname + port, optionally with TLS client certificates). The search API token and syslog credentials are separate, providing some access separation. For agents only querying logs (not ingesting), the API token provides read access without syslog credential exposure.

Documentation at papertrail.com/help covers setup guides for various platforms (Linux, macOS, Windows, Heroku, Docker, AWS, etc.), API reference, and alerting configuration. The syslog setup documentation is comprehensive — covering rsyslog, syslog-ng, nxlog, and application-specific configurations. API reference covers search, systems, groups, and alerts. The documentation's strength: platform-specific setup guides that get logging working in minutes. For agents, the Search API documentation and the alert configuration guide are the most relevant. The documentation reflects Papertrail's maturity — it's thorough for the established features. No official SDKs — agents use raw HTTP for the search API.

Search API at papertrailapp.com/api/v1/events/search.json with query string parameter. Search supports full-text search across all log sources. Filtering by system (source), group, time range, and severity. Pagination uses min_id/max_id for cursor-based traversal. Systems API lists configured log sources. Groups API manages source groupings. Saved searches API manages named search filters. Alerts API manages alerting rules. The API is read-heavy — there's no HTTP-based log ingestion endpoint (syslog is the ingestion path). The search query syntax supports simple text matching and source filtering. For agents querying logs programmatically, the Search API is functional but limited compared to APL or SQL-based query languages.

API errors return JSON with error message. Standard HTTP status codes. Rate limits: search API is rate-limited per-account — specific thresholds aren't publicly documented. Log retention is plan-based: free tier retains logs for 2 days with 100MB/month. Paid plans increase retention and volume. Archive to S3 provides long-term storage beyond the retention window. Search performance depends on volume and time range — narrow time ranges return faster. Syslog ingestion is fire-and-forget — no delivery confirmation. The main reliability consideration: log volume limits on lower plans mean agents must monitor volume to avoid data loss (logs exceeding the plan limit may be dropped).