WD NAS App Builder
Loki 3.7.9-3
Loki and Vector: collect the NAS's and apps' logs, searchable in Grafana
monitoring
Download
| NAS | Size | SHA256 | |
|---|---|---|---|
| My Cloud PR4100 | 99 MB | Download | a678a5cb11672388… |
| My Cloud PR2100 | 99 MB | Download | fbed3f4037bf112d… |
| My Cloud DL4100 | 99 MB | Download | c206d31ddb07459a… |
| My Cloud DL2100 | 99 MB | Download | 891775d3b963decc… |
| My Cloud EX4100 | 93 MB | Download | 3de370512017d7ac… |
| My Cloud EX2100 | 93 MB | Download | a4a3e721f3a60ed0… |
| My Cloud EX2 Ultra | 93 MB | Download | 4ed9a762c0da1b9f… |
| My Cloud Mirror (Gen 2) | 93 MB | Download | 58c3b9aa01f7683b… |
| My Cloud (Gen 2) | 93 MB | Download | 5ab1ddf847126406… |
| WD Cloud | 93 MB | Download | 0e961f94050b6bbc… |
Easier: install it from the Store, which also updates it.
Collects the NAS's logs in one place, searchable in Grafana:
- Grafana Loki stores the log lines - like Prometheus does for metrics, it indexes only their labels, which keeps it light.
- Vector reads the log files (and Docker containers' output) as they're written, labels each line and sends it to Loki. It's used instead of Grafana Alloy (Grafana's own collector, which replaced the retired Promtail): it does the same job here at a third of the size (a 57MB download, against 170MB) and a fraction of the memory.
What's collected (each source can be turned off on the management page):
| Source | Logs | Labelled |
|---|---|---|
| The NAS itself | /var/log/*.log (the system log user.log, kern.log, daemon.log, sshd.log, WD's nasAdmin.log, wdlog.log, wdhwlib.log, event.log, otaclient.log…) and Samba's logs - not WD's private or analytics logs | source="system", app="user", "kern", "sshd"… |
| The apps | Nas_Prog/_<app>/*.log (e.g. Vaultwarden, Uptime Kuma, Prometheus, Grafana, Docker, PHP), the Nginx app's logs, Node Exporter's, and the app scripts' /tmp/debug_apkg | source="app", app="vaultwarden", "nginx", "app-scripts"… |
| Docker | every container's output, while Docker runs (restart this app after starting Docker) | source="docker", app=<container name> |
Every line also has a host label (the NAS's name). When it first starts, Vector reads back up to a day of each log.
- With the Grafana app installed, Loki becomes a data source and a NAS logs dashboard appears in the NAS folder: lines and errors / warnings over time by app, and the log lines themselves, filtered by source, app and search text. Explore (with the Loki data source) allows any LogQL query, e.g.
{app="sshd"} |= "Failed password". - Logs are kept for 30 days by default (adjustable on the page).
- Loki is reachable on the NAS itself only (
127.0.0.1:3100- it has no login). It runs as its ownlokiuser (created by the app, ID 75). Vector runs as root, as many logs are readable by root only - it only reads them, and sends them to Loki. - Its data is kept next to the app, e.g.
/mnt/HD/HD_a2/Nas_Prog/_loki, and survives reinstalls and removal: Loki's databasedata/, Vector's place in each filevector/, the generatedloki.yamlandvector.yaml, the page'ssettings, and the two programs' own logs (warnings only, kept under 1MB - not collected, so that the app never reads what it writes about itself). - Both are official static programs (prepared by
static/loki). Neither updates itself: updates come with new versions of the app, and the NAS shows an alert when a new Loki release is out, checked weekly. - For the Intel and ARM models (the ARM ones' packages are checked under emulation when they're built, but haven't yet been tried on an ARM NAS) - and it's heavy for them: workable with 1-2GB of memory (e.g. an EX4100), too much for the 512MB single-drive My Cloud.
Management page
The app's page in the NAS dashboard (Apps → Loki) shows whether Loki and Vector are running, their versions, how much is stored, and what has been collected in the last 24 hours (lines per log). It sets how many days to keep and which sources to collect, restarts both, and shows their latest warnings. Only NAS admins can use the page (see Management pages).