Agents
How-to

Review Agent health and logs

Interpret Agent health conditions, inspect live Runtime logs and retained session snapshots, diagnose failures, and verify recovery.

For
Agent operators, Agent viewers, Agent editors, Agent owners, Organization administrators, and support engineers
On this page
  1. Overview
  2. Health model
  3. Before you begin
  4. Diagnostic workflow
  5. 1. Open the Agent
  6. 2. Interpret Agent health
  7. 3. Review live logs
  8. 4. Review log history
  9. 5. Correlate related activity
  10. 6. Recover and verify the Agent
  11. Log retention
  12. Health and log API
  13. Log security
  14. Troubleshooting
  15. Next steps

Agent health tells you whether an Agent’s Runtime is ready to work. Logs show what happened during startup and execution, including the details needed to investigate connection, configuration, and Runtime failures.

Use the two signals together. A health condition identifies the current operational state; Logs provide the sequence of events that led to it.

Overview

The Agent detail page combines several diagnostic signals. Each one answers a different question, and a complete diagnosis usually needs more than one.

Signal What it tells you
Agent conditionWhether the Agent is Idle, Initializing, Working, Disconnected, or Needs attention
Error reasonA concise explanation, when Agent Barn or the Runtime can identify the failure
Live logsCurrent output from a Running Agent’s Runtime
Log snapshotsRetained output from recently ended Runtime sessions
ConversationsWhether platform messages reached the Agent, and whether responses were recorded
Tool callsWhether external Tool Call executions are pending, successful, or in error

Health and Logs are subordinate Agent resources. Users must have access to the Agent and the activity.read Permission to view them.

Health model

Agent Barn combines the persisted Agent lifecycle state with a Runtime health probe to produce the condition shown in the interface.

Persisted state Runtime health Displayed condition Meaning
Stopped Not queried Idle The Agent is intentionally not running
Running Not available yet, starting, or initializing Initializing Runtime resources are starting, or the platform connection has not completed
Running Healthy Working The Runtime and configured platform connection report healthy
Running Unreachable or unhealthy Disconnected The Agent is marked Running, but its Runtime health cannot currently be confirmed
Running Container crashed Needs attention The Agent’s workload exited, or is repeatedly failing
Error Stored failure Needs attention Agent Barn could not complete a lifecycle operation such as startup

The persisted state and the displayed condition answer different questions:

  • The persisted state records the lifecycle operation Agent Barn last completed.
  • Runtime health reports what the active workload is currently experiencing.
  • The displayed condition combines those signals into an operator-facing label.

For example, an Agent may remain persisted as Running while showing Disconnected, because its workload exists but its platform connection or health endpoint is unavailable.

Before you begin

You need:

  • Access to the Organization that owns the Agent
  • Access to the Agent
  • The activity.read Permission
  • A recent estimate of when the problem began
  • The platform location, user, or operation involved
  • The agent.lifecycle.manage Permission, if recovery requires Pause or Start
  • The agent.update Permission, if recovery requires a configuration change
  • The agent.secret.manage Permission, if recovery requires replacing credentials

Agent Viewer, Agent Editor, and Agent Owner include activity and log access by default. Organization Owners and Organization Administrators have implicit authority over Agents in their Organization.

Diagnostic workflow

Use this order when investigating an Agent.

  1. Condition
  2. Error reason
  3. Logs
  4. Related activity
  5. Correction
  6. Verification
  1. Identify the Agent’s displayed condition.
  2. Read any error reason shown under the Agent header.
  3. Open Logs and find the first relevant failure.
  4. Compare the timestamp with Conversations and Tool Calls.
  5. Correct the underlying configuration, credential, platform, or Runtime problem.
  6. Start or restart the Agent.
  7. Confirm that it returns to Working and responds through its platform.

Open the Agent

  1. Select the Organization that owns the Agent.
  2. Open the Agent from Home.
  3. Review the condition shown under its name.
  4. Look for an error banner beneath the Agent header.
  5. Select Logs.

Users with activity.read can also see:

  • Conversations
  • Tool calls
  • Logs
  • Work

The About tab remains available independently of activity access.

If the diagnostic tabs are missing, confirm that your effective Agent Access Role includes activity.read.

Interpret Agent health

The Agent condition refreshes automatically while the Agent is Running or in Error. It is derived from two separate inputs: the lifecycle state Agent Barn has persisted, and the health the Runtime currently reports.

Condition Persisted state First action
Idle Stopped Review the latest snapshot; Start only when the Agent should resume work
Initializing Running Wait briefly, then read Logs if the condition does not change
Working Running Investigate the specific Conversation, Tool Call, or integration instead
Disconnected Running Read the error reason, then inspect the most recent live Logs
Needs attention Running or Error Open Logs before changing the Agent

Idle

Idle means the Agent is Stopped.

This is not a failure. Agent Barn does not query Runtime health, because an active Runtime is not expected.

Review the most recent Log snapshot if you need to understand the previous session. Select Start only when the Agent should resume work.

Initializing

Initializing means the Agent is marked Running, but is not ready yet.

This condition is expected briefly while Agent Barn:

  • Creates Runtime resources
  • Starts the Agent container
  • Loads the selected Template and Skills
  • Configures integrations
  • Connects to the communication platform
  • Begins reporting health

Wait for the condition to change to Working. If it remains Initializing, review Logs for:

  • Image download problems
  • Missing configuration
  • Invalid platform credentials
  • Missing channels
  • Platform connection timeouts
  • Repeated Runtime startup failures

A Runtime that has not connected successfully yet can continue to report a starting state, rather than an established connection failure.

Working

Working means the Runtime health endpoint and configured platform connection report healthy.

This confirms Runtime availability, but it does not guarantee that:

  • Every platform message satisfies the Agent’s access policy
  • Every Tool Call will succeed
  • Every integration credential is valid
  • The Agent’s Template will produce the intended answer

When investigating a functional problem on an otherwise Working Agent, continue with Conversations, Tool Calls, and Logs.

Disconnected

Disconnected means the Agent is persisted as Running, but Agent Barn cannot currently confirm healthy Runtime operation.

Possible causes include:

  • The Runtime health endpoint is temporarily unreachable
  • The platform connection failed after previously working
  • Platform credentials were revoked or expired
  • Network connectivity to the platform is unavailable
  • The Runtime is still recovering
  • The log or health request encountered a temporary infrastructure problem

Read the error reason if one is available, then inspect the most recent live Logs.

Hermes retries retryable platform connection failures. If repeated failures open its platform circuit breaker, Kubernetes may restart the Agent workload after approximately five minutes. Continue investigating the underlying credential, configuration, or platform problem, rather than relying only on the restart.

Needs attention

Needs attention means either:

  • Agent Barn persisted the Agent in Error after a failed lifecycle operation, or
  • The Running workload is in a crashed condition.

The error banner may include a friendly reason such as:

  • Agent is crashing repeatedly on startup
  • Agent was killed because it ran out of memory
  • Failed to pull the Agent image
  • A Secret or environment variable may be missing
  • The Agent process exited unexpectedly
  • A Kubernetes resource or permission problem prevented startup

Open Logs before changing the Agent. The last lines often show the more specific Runtime or platform failure.

Review live logs

When an Agent is Running, the Logs tab displays Live logs.

Agent Barn initially loads recent Runtime output, and then opens a live server-sent event stream for new lines. While the stream is connected, the header displays Streaming.

Live logs Streaming
[startup output]
[platform connection output]
[runtime operation output]
[integration or error output]
Jump to latest

This is a visual example of the interface layout. The lines above are placeholders, not product output.

The displayed text comes directly from the Agent Runtime. Exact messages differ between Hermes and OpenClaw, and between communication platforms.

Follow new output

The log viewer stays near the newest line while you remain at the bottom.

If you scroll upward, automatic following pauses so that new output does not move the section you are reading. Select Jump to latest to return to the newest line.

Search for the first relevant failure

When diagnosing startup, begin near the earliest line from the current session and look for terms such as:

Log search terms
error
failed
invalid
unauthorized
forbidden
timeout
connection
token
credential
CrashLoopBackOff
OOMKilled
ImagePullBackOff

Read the surrounding lines. The first error is often more useful than later failures caused by the same problem.

Reproduce one controlled request

If the Agent is Working but a particular operation fails:

  1. Keep Logs open.
  2. Send one controlled platform request.
  3. Note the request time.
  4. Watch for the related Runtime output.
  5. Compare the result with Conversations and Tool calls.

Avoid sending many repeated tests at once. They make timestamps and causality harder to interpret.

Live-log display limit

The web log viewer retains up to 10,000 lines in its active browser buffer. When more lines arrive, it keeps the newest lines.

This browser limit is separate from stored Log snapshot retention.

Review log history

When an Agent is not Running, Logs shows output from the latest retained Runtime session.

Agent Barn attempts to capture a Log snapshot before it stops an Agent, including a stop performed as part of Apply & Restart.

Scroll toward the beginning of the log viewer to load older retained sessions. Sessions are separated with a marker:

  • Latest session

    Live output while Running, or the newest retained snapshot when the Agent is not Running

  • === Session ended 8/29/2026, 10:42:18 AM ===
  • Previous session

    The snapshot captured when that Runtime session ended

  • === Session ended 8/28/2026, 4:07:52 PM ===
  • Older sessions

    Loaded as you continue scrolling, until the oldest retained snapshot

This lets you compare the current or latest session with earlier starts. Useful comparisons include:

  • The last Working session versus the first failing session
  • Configuration before and after Apply & Restart
  • Platform connection output before and after credential replacement
  • Repeated startup failures across several attempts

An empty Log view can mean:

  • The Agent has never produced Runtime output
  • The Agent has never completed a session that produced a snapshot
  • The latest session produced no output
  • Snapshot capture failed
  • Older snapshots exceeded the retention window

It does not prove that no Agent activity occurred.

Correlate related activity

Logs are most useful when combined with the other Agent activity tabs.

Conversations

Did Agent Barn ingest the inbound message or outbound response?

Tool calls

Did an external Tool Call begin, succeed, or fail?

Logs

What did the Runtime report while processing the message or Tool Call?

Conversations

Use Conversations to confirm:

  • The platform message reached the Agent
  • The message appeared in the expected channel or direct message
  • The correct thread was used
  • An outbound response was recorded

If a message does not appear, investigate platform delivery, channel access, mention gating, and bot membership before assuming the Agent’s Template failed.

Tool calls

Use Tool calls to inspect external executions with these states:

  • Pending
  • Success
  • Error

A Working Agent can still have an individual Tool Call in Error. Open Logs around the Tool Call’s timestamp to find provider, credential, validation, or network details.

Logs

Use Logs for Runtime-level evidence such as:

  • Startup sequencing
  • Platform connection attempts
  • Model or proxy errors
  • Skill loading
  • Integration failures
  • Runtime exceptions
  • Shutdown and restart behavior

Logs are operational output. They are not the canonical record of Conversations or Tool Calls.

Recover and verify the Agent

Choose the recovery action based on the condition and the evidence you collected.

Condition Recommended action
IdleReview the last snapshot, then Start when appropriate
Initializing, brieflyWait and continue observing
Initializing, for an extended periodInspect Logs, correct startup configuration, then Pause and Start if necessary
Working, with a failed operationInvestigate the specific Conversation, Tool Call, Skill, or integration
DisconnectedInspect the error reason and Logs; correct credentials, network, or platform configuration
Needs attention, with persisted ErrorCorrect the cause, apply configuration if needed, then Start
Needs attention, with a crashed workloadCapture the evidence, Pause, correct the cause, and Start again

Correct configuration problems

Open Configuration when Logs indicate problems with:

  • Model selection
  • Template or required Skills
  • Channel access
  • Platform routing
  • Runtime-specific settings

A Running Agent uses Apply & Restart. A Stopped Agent, or an Agent in Error, uses Apply.

Correct credential problems

Open Configuration → Keys & integrations when Logs report invalid, revoked, expired, or missing platform or provider credentials.

Credential changes require agent.secret.manage.

Because Secret values are write-only, Agent Barn shows credential metadata rather than returning stored plaintext. Enter the replacement value, and validate the integration where that option is available.

Restart a Running or crashed Agent

Agent Barn does not provide a separate one-click Restart action.

  1. Select Pause.
  2. Wait for the Agent to become Idle.
  3. Select Start.
  4. Wait for Initializing to become Working.

Starting regenerates Runtime configuration, platform settings, integration material, and ingest identity from the Agent’s currently selected configuration.

Verify recovery

After recovery:

  • Confirm that the condition changes to Working
  • Confirm that Live logs shows Streaming
  • Check that the original startup or connection error no longer repeats
  • Send one controlled platform request
  • Confirm that the inbound message appears in Conversations
  • Confirm that the Agent produces the expected response
  • Check any expected Tool Call
  • Continue observing briefly for recurring failures

Do not treat a successful Start response alone as recovery. The Agent should reach Working and complete an end-to-end platform interaction.

Log retention

Agent Barn retains a bounded amount of Runtime output for each Agent.

Retention per Agent
Snapshot timing
Captured before the Agent stops, on a best-effort basis
Retained sessions
The newest five snapshots
Lines requested during capture
Up to 50,000 recent lines
Maximum stored snapshot size
One MiB
Truncation behavior
Keeps the newest content when the size limit is exceeded
Live browser buffer
Up to 10,000 displayed lines

Older snapshots are deleted as newer snapshots are saved. The Logs tab is therefore intended for recent operational diagnosis, not permanent audit retention or compliance storage.

If long-term retention is required, configure an external logging and observability system for the deployment.

Health and log API

All of these endpoints require access to the Agent and the activity.read Permission.

Method and endpoint Purpose
GET /agents/{agent_id}/healthzReturn the current Runtime health for a Running Agent, or the stored reason for an Agent in Error
GET /agents/{agent_id}/logsReturn recent live lines when Running, or recent lines from the latest snapshot when not Running
GET /agents/{agent_id}/logs/streamStream live Runtime lines through server-sent events
GET /agents/{agent_id}/logs/historyReturn a retained snapshot, and identify the next older snapshot

These routes are under the active Organization API base path.

Health response

A health response contains:

Health response
{
  "status": "ok",
  "reason": null
}

Runtime responses can report statuses such as ok, starting, initializing, error, and crashed.

The web application converts those Runtime-oriented states into the user-facing conditions documented above.

Requesting health for a Stopped Agent returns a conflict, because an active Runtime is not expected.

Recent Logs

GET /agents/{agent_id}/logs accepts tail_lines from 1 through 10000. The default is 100.

The response identifies whether the lines came from the live workload or a stored snapshot:

Recent logs response
{
  "lines": [
    "runtime output"
  ],
  "source": "live",
  "has_snapshots": true,
  "snapshot_id": null,
  "session_started_at": null,
  "session_ended_at": null
}

The source value is either live or snapshot.

Live stream

GET /agents/{agent_id}/logs/stream returns text/event-stream.

The optional tail_lines parameter accepts values from 0 through 1000. A value of 0 begins with newly emitted lines rather than replaying an initial tail.

A non-Running Agent produces no live stream lines.

Snapshot history

Call GET /agents/{agent_id}/logs/history without snapshot_id to obtain the latest retained snapshot.

Use the returned next_snapshot_id as the snapshot_id query parameter to request the next older session. Continue until has_more is false.

Log security

When handling Logs:

  • Share them only with people authorized to access the Agent
  • Redact user content and identifiers before placing excerpts in an external issue
  • Never paste replacement credentials, tokens, or Secret values into a diagnostic message
  • Review external provider errors before sharing them publicly
  • Use the smallest relevant excerpt
  • Include timestamps and the Agent condition with the excerpt
  • Avoid copying unrelated Conversation or Tool Call content

Granting someone an Agent Viewer role gives them access to Agent activity and Logs. Review Agent sharing when log visibility must be restricted.

Troubleshooting

Health remains Initializing

Review Logs for startup failures. Check that:

  • The Runtime image can be pulled
  • Required Secrets and environment configuration exist
  • The selected Template and Skills are valid
  • Platform credentials are valid
  • The platform connection can be established
  • The Agent has sufficient time to complete startup

If the evidence shows startup is stuck, Pause the Agent, correct the cause, and Start it again.

The Agent shows Disconnected but still responds

The health request may have encountered a temporary failure while the Runtime continued processing messages.

Wait for the next automatic health refresh and review live Logs. If Disconnected persists, investigate the health endpoint, the platform connection, and the deployment network.

The Agent shows Working but does not respond

Working confirms Runtime and platform health, not message eligibility. Check that:

  • The Agent is in the correct channel, chat, or server
  • The location satisfies the configured access policy
  • The user satisfies any user or role restriction
  • The message explicitly mentions the Agent where required
  • The inbound message appears in Conversations
  • The selected Template permits the requested behavior

See Configure channel access.

Logs show an invalid token or unauthorized error

Determine whether the failure concerns:

  • Platform credentials
  • Model or LiteLLM access
  • A Skill provider
  • Another integration

Replace the relevant credential under Keys & integrations, apply the change, and verify the Agent after restart.

Logs show CrashLoopBackOff

Find the earliest startup error before the repeated crash messages. Common causes include:

  • Invalid Runtime configuration
  • Missing Secret material
  • A failing startup command
  • An unavailable dependency
  • Runtime incompatibility

Correct the cause before repeatedly starting the Agent.

Logs show OOMKilled

The Agent exceeded its available memory.

Collect the surrounding log output, and review the workload’s memory requirements and deployment limits. Repeatedly restarting without changing the resource condition is unlikely to resolve it.

Logs show ImagePullBackOff or ErrImagePull

Confirm that:

  • The image exists
  • The configured image tag is valid
  • The cluster can reach the registry
  • Required registry credentials are available

This is a deployment problem rather than an Agent Template problem.

The live stream stops updating

Confirm that:

  • The Agent is still Running
  • Your authenticated session is still valid
  • The browser can maintain the server-sent event connection
  • The API can stream Kubernetes pod Logs

The web application attempts to reconnect the stream automatically. Reload the Logs tab if the connection does not recover.

No Logs are available after stopping

Snapshot capture is best effort. It may fail if the workload has already disappeared, Kubernetes cannot return the Logs, or the Runtime emitted no output.

Use Conversations, Tool Calls, deployment observability, and any external log aggregation available to the operator.

Older Logs disappeared

Agent Barn retains only the newest five session snapshots. This is expected once newer snapshots replace older history.

Use external log aggregation when longer retention is required.

The Logs tab is missing

Your effective Agent Permissions do not include activity.read.

Ask an Agent Owner or Organization administrator to review your Agent Access Role.

Next steps

After reviewing health and Logs:

Documentation