Logs, retention & drains

aloof logs api                         # live: platform events + recent output of each instance
aloof history api --since 24 --grep error
aloof drains api add https://logs.example.com/ingest
aloof drains api add syslog+tls://logs.example.com:6514
aloof drains api list | remove drn_…

Retention: stdout/stderr and platform events are collected every few seconds and kept for 1 day (Free), 7 days (Hobby) or 30 days (Pro). Query them with GET /v1/apps/{name}/logs/history?since=&contains=.

Drains forward every line as it's collected. HTTPS drains receive a JSON array of {ts, app, instance, stream, message} per POST, and credentials in the URL (https://user:token@host/path) are sent as Basic auth. Syslog drains (syslog+tls, syslog+tcp, syslog+udp) receive RFC 5424 lines with octet-counting framing on TCP/TLS. Drain URLs are encrypted at rest and shown redacted, and private or loopback targets are refused.