Diagnostics & Debugging

Keel records a full diagnostic trace of every command to a rotating log file at ~/.keel/logs/keel.log, independent of console output, and captures panics. Use the keel debug commands when reporting or investigating a bug.

# Show recent diagnostic log entries (last 50 lines by default)
keel debug logs
keel debug logs -n 200
keel debug logs --follow        # stream new entries as they are written
keel debug logs --all

# Print the path to the log file
keel debug path

# Print version, platform, and log diagnostics for bug reports
keel debug info

Verbose and cautious modes

Two project-level behaviors change how commands communicate as they run. They are persisted in keel.yml under settings: and apply across every environment; command-line flags override them for a single invocation.

• verbose — narrate every action a command takes as it happens.
• cautious — preview the bulleted list of actions a command will take and ask for confirmation before it changes any AWS state.

keel settings                       # list current values
keel settings get cautious
keel settings set cautious true

keel deploy --verbose               # override for a single run
keel up --cautious

You can also toggle both from the dashboard's settings overlay (s), which persists the change to keel.yml.

Recovering from an interrupted operation

An interrupted keel up or keel destroy (Ctrl-C, lost connection, cancelled CI job) can leave a state lock held or resources untracked. keel rescue diagnoses and repairs both — see Interruptions & Rescue.

What's in the log — and what isn't

The debug log records every AWS call, subprocess invocation, and error with full context. It deliberately never contains MFA seeds, otpauth:// URIs, secret values from SSM, or access keys — the log lives on the same disk as your credentials, and logging a second factor next to the first would defeat it.