I have my hubs setup to send me a pushover when they reboot with the version number. Occasionally I wake up and I see that hub rebooted in the night. I have no idea why that hub decided to reboot.
As far as I know the logs are wiped on each reboot? I have started to look into splunk to keep my logs but that is not easy to use so I haven't mastered it yet.
Are there any native options to find out what is going on? Thanks.
To follow up on this I did check Splunk and there is nothing:
One log entry shows normal activity and the next shows the startup message. It's as if the plug were pulled but all hubs are plugged into a UPS.
False, but if you don't have a rule or some other mechanism set to reboot your hub you may want to ask @bobbyD if someone can check the engineering logs to see what is happening.
Thanks. How do I look at logs from 3:37am yesterday morning? I can't figure it out.
Whether that timeframe is available or not will depend on the amount of logging you have set on, but if you go to the log tab and scroll down you will eventually get there or reach the end of the log. (Looking at my main hub the logs currently go back to ~2300 21 Oct 2024 - YMMV.)
I had something like this happening for the longest time... and it turned out to be nothing to do with Hubitat!
I had the hub plugged into a KASA wifi plug (to enable remote start etc.). It was also plugged into a UPS. Turned out that the KASA plug had a firmware update and after I updated that, the problem went away. Still not sure what was causing it to cut out, but the engineering logs were clean (all they showed was that the hub restarted).
I don’t see, nor can find, anyway to specify how long to keep the logs? It seems that they cull automatically, presumably based on space and logging level.
Also paging through the logs clicking show more is not really a suitable option as it appears this could be an awful lot of clicks to go back 24 hours back, and no guarantee that it is even there.
I was able to decipher Splunk and don’t see anything leading up to the event. So it looks like power was interrupted or the hub spontaneously shutdown.
The fact that it is happening on more than one hub leads me to think it is a power issue.
Have you checked the other tabs on the logs page, like location or hub events?
IIRC log size is capped at about ~10MB.
I generally just grab the slider at the side of the page and pull down - a lot quicker than clicking.
Pulling the slider down only gets me to the next Show More and then I have to click on it?
Pondering this further. I have certain devices/rules setup at elevated logging levels. I do this when I am trying to debug something. Naturally I don't go back and turn this off (usually). As a result this creates a lot more chatter and probably cuts down on how much history I have.
I am getting more comfortable with Splunk and this seems to be the best option for me. In theory I would turn on logging for most things and send it over to Splunk. Hubitat will only keep a very small time window as it would fill the 10MB limit quickly.
The question that comes to mind. If I increase the amount of logging, for example turn on all three log options on every rule. This would give me everything I need in Splunk but would it burden the hub too much and impact performance?
Can you explain this in more detail? Happy for it to be another topic....
I hadn't but I have now. I checked the two hubs that restarted and don't see much. I can see that Sunrise/Sunset was updated before they restarted but that appears to happen regularly. Hub events shows nothing other than the startup. The other tabs are either blank or refer to information since startup.
Was there something in particular you were thinking could be used here? Thanks.
Yeah, sorry, the request was more a general one to understand more about how to use Splunk, etc.... So, like I said, happy to fork it off into another conversation rather than mix it up in this one...
We could move that over to this thread?
Thanks @simon4 , another project to read up on.... 
Download the Hubitat app
