Docs · set-up · new in 2.30
One-command log set-up: one line on your server
One-command log set-up sends your site's access log to Skald from one line you run on the web server. Skald makes the sending token, the installer finds the log, and the Test starts by itself.
One-command log set-up is Skald's installer for a Linux web server with nginx or Apache. One curl line, made for one site, installs a small log shipper (with Docker when the server has it, else as a systemd service) that sends the log's new lines to your Skald over HTTPS.
30-day free trial · no card · we set it up within one working day · free to self-host
$ curl -fsSL https://<your Skald>/traffic-kit/<code> | sudo bash Skald: installing the log shipper for example.com. == 1. How it runs here with systemd (no Docker; Python 3.12 and systemd are here) == 2. The access log of example.com found in the web server's settings: /var/log/nginx/example.com.access.log == Check waiting 20 seconds for the first batch... Done. The shipper for example.com runs with systemd.
Sample run. The real command, with your own code in it, is in Settings > Connections.
[01] what it does
What the one-command installer does on your server
The command fetches an installer made for one site, then works through four steps and prints each one. It reads the log. It never changes nginx, Apache or the website. This is how server log analytics reaches a site that runs on another server.
How it runs here
Docker when Docker works on the server. Else a systemd service with Python 3.9 or newer. A shipper installed before keeps its way.
The access log
It reads nginx's and Apache's settings for the block that serves your site, and takes its access log. Several: it asks. None: it tries the usual places.
The token
The sending token is inside the command. It is saved on the server, readable by root and the shipper only, and never printed.
Check
It waits 20 seconds for the first batch, shows the shipper's last lines, and ends with a short Done block and your dashboard link.
The link in the command works once, for 24 hours. Skald keeps only a hash of its code, and the token sealed with it, so Skald's disk never holds a usable token.
[02] with or without Docker
With Docker or without: the installer picks
You do not choose. The installer looks at the server and takes the way that works there. Flip the switch to see what each way leaves behind.
- a container named skald-ship, from your Skald's imagerunning
- the log folder mounted read-onlyread only
- runs as its own user in group adm, 128 MB of memory at mostsmall
- the token in /srv/skald/ship-token (root:adm, 0640)never printed
See what it says: sudo docker logs --tail 20 skald-ship. The Docker way was checked by dry run before 2.30.0 shipped, not yet on a real server.
- the skald-ship service, started at boot and restarted if it stopsrunning
- its own user, skald-ship, in group adm, which may read the logread only
- a locked-down unit: read-only /var/log, no new privilegessmall
- the token in /etc/skald-ship/token (root:skald-ship, 0640)never printed
See what it says: journalctl -u skald-ship -n 20. Checked on a clean Ubuntu 24.04 with nginx and two sites: it picked the right site's log and every line arrived.
[03] options
Installer options: --log, --yes and --dry-run
Most servers need none. When the installer cannot tell which log is the site's, or you want to read every step first, add an option.
Piped, options go after bash -s --. Or press Download as one file in the same step: the same installer as skald-install-<site>.sh, with the token inside, to read before you run it.
| Option | What it does |
|---|---|
--dry-run | Shows every step and every command, changes nothing |
--log <path> | Names the site's access log yourself |
--yes | Asks nothing and takes the log it found |
curl -fsSL <link> | sudo bash -s -- --log /var/log/nginx/example.com.access.log
sudo bash skald-install-example.com.sh --dry-run
Templates: the link and the file name are your own site's.
[04] check and undo
Check the log shipper with skald-ship-check
The installer leaves two commands on the server. One checks every part and changes nothing. The other removes only what the installer put there.
Each line says ✓ OK, ✗ PROBLEM with a fix under it, or ? CANNOT TELL. Fix the first problem, then run it again. Its last block, Copy this and send it to us, holds no token, and every IP address in it is masked.
In Skald, the Test step starts by itself and checks every 5 seconds for up to 2 minutes: Connected: 1,240 lines received today, the last at 10:42, or the reason a batch was refused, with the fix.
$ sudo skald-ship-check ✓ OK the access log is growing (written in the last 10 minutes) ✓ OK the send address answers (401 without a token is expected) ✓ OK skald-ship is running (0 restarts) ✓ OK lines are leaving: the shipper sent some in the last 10 minutes All OK.
$ sudo skald-ship-uninstall
Sample output of skald-ship-check.
[05] other ways
Other ways in, and what the one command does not do
Not the one running the server? The same step can send the whole set-up to the person who is, or to an AI coding agent.
Email it to your server admin
The set-up pack by mail: the installer, the steps for every case, and a CLAUDE.md for an AI coding agent.
Share with your developer
A private link with this one task's steps filled in, for 1, 7 or 30 days. The token is made when they press Show the secret.
By hand, with or without Docker
Under Other ways: the same steps as plain commands, and the older install kit as a zip.
What it does not do
- It is for Linux servers. A site on Microsoft IIS, Shopify, Webflow or Squarespace has no log it can read: use the script tag, which sees no AI crawlers or bots.
- It never edits your web server. The optional log fields (the Next.js prefetch header, the request's size) are a line you add yourself.
- Behind a CDN, pages the CDN answers from its cache never reach your server's log. Use the CDN's own road for those.
- The command and the one file hold the site's sending token. Send them only to the site's admin.
keep reading
More on one-command log set-up
questions
One-command log set-up FAQ
Straight answers, including what Skald does not do.
Do I need Docker for the one-command set-up?
No. The installer uses Docker when Docker works on the server. Without it, it runs the shipper as a small systemd service with Python 3.9 or newer, and the shipper is inside the installer file. With neither, it stops and says what to install.
Is it safe to pipe the command into sudo bash?
The installer only reads the access log. It never changes nginx, Apache or the website. To read it before it runs, use Download as one file, then run it with --dry-run: it shows every step and changes nothing. The command holds the site's sending token, so send it only to the site's admin.
What if the installer picks the wrong access log?
Run it again with --log and the full path of the site's log. Piped, that is curl -fsSL <link> | sudo bash -s -- --log /var/log/nginx/example.com.access.log. When the server's settings name several logs for the site, it asks, biggest first. With --yes it asks nothing and takes what it found.
The command says the install link was used or has expired. What now?
The link works once, for 24 hours. A used or expired link changes nothing on the server. Press Make a new command in the Run step and run the new one. Opening the link in a browser or a mail's preview only shows the command, and does not use it up.
Can I run the installer again?
Yes. Running it again is safe: the shipper keeps its way and its place in the log, so no line is sent twice. A shipper of the other way is removed, so only one sends.
How do I remove the shipper?
Run sudo skald-ship-uninstall on the web server. It removes only what the installer put there, including itself and skald-ship-check.
$ tail -f access.log | skald
See what AI does with your site. Free for 30 days.
No card. We set up hosted Skald for you within one working day, or you self-host it free. Every line of your log, sorted and added up.