CustosStructured diagnostic logs are written locally as JSONL under ProgramData. They are separate from the timeline database and are not uploaded to CustosXI servers.
Log categories
Each category has its own folder and rotation rules:
- App - general application messages
- Error - warnings and errors (longer retention by default)
- Audit - security-relevant actions and policy events
- Navigation - UI navigation trace
- Ipc - UI ↔ Worker pipe communication
- Security - security subsystem events
- Perf - performance sampling (off by default in Production)
Settings → Logging
- Presets: Production, Diagnostic (verbose), Audit only, or Custom
- Global minimum severity and depth - depth controls how much detail is stored (properties, stack traces), not just log level
- Rotation defaults: max MB per file, max files per category, retention days, cleanup interval
- Per-category overrides - enable/disable, min level, depth, file limits, sampling (Perf)
- Redaction of sensitive keys (passwords, tokens, API keys, connection strings)
- Actions: Save and reload (Worker picks up changes), Cleanup now, Open log folder, Test write
Log Center (in-app viewer)
Open from Settings to browse and investigate logs without leaving CustosXI:
- Select a category and log file from the file list (rotated files and the active
livefile) - Filter by minimum level and free-text search within the current file
- Live tail follows new lines on the newest file for the selected category
- Copy selected lines for support tickets or internal review
Default Production preset keeps balanced disk use (typical rotation: ~20 MB per file, 14-90 day retention depending on category). Use Diagnostic temporarily when troubleshooting, then return to Production.