Hi there,
The Supervisor talks directly to the balenaEngine socket to manager application service images and containers. As such, it uses this socket to retrieve logs from containers rather than relying on storage for logs (this could very easily fill the storage media very quickly, and prolonged writes especially on SD media will wear the media down significantly). These logs are then processed and sent to our own log retention system.
You can subscribe to the logs for a device, for example using the SDK (see here https://www.balena.io/docs/reference/sdk/node-sdk/#balenalogs--codeobjectcode), to consume all output from your service containers.
Examining the journal file for balenaEngine will also allow you to read the logs for the current session (using journalctl -f -n 1000 -a -u balena will show you the last 1000 lines from balenaEngine’s journal), although this will show everything from all containers. If you want to ‘scrape’ specific containers, you can discover the container ID for the specific service you want logs for and grep through the balenaEngine output (eg. journalctl -f -n 1000 -a -u balena | grep 1234567 will only show you output from the container with ID 1234567 that was present in the last 1000 lines of journal from balenaEngine).
Please let us know if this answers your question, or if you have any others.
Best regards,
Heds