> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/local-log-bundle.md).
# Local log bundle
Synchronous on-appliance log-bundle stream. Distinct from the tenant-side asynchronous flow under `broker-papi.yaml`'s `logs` tag — that one is request → poll → download against the cloud, this one is a single POST that streams the bundle back as `application/octet-stream`.
## Stream the on-appliance log bundle
> Collect and stream the on-appliance log bundle back to the caller\
> as \`application/octet-stream\` (a gzipped tar archive).\
> \
> The collector is \*\*single-writer\*\*: only one bundle generation\
> runs at a time. A concurrent call returns \`503\` with\
> \`Retry-After: 60\`.\
> \
> \- \*\*Authentication:\*\* Bearer token from \[\`generateToken\`]\(#operation/generateToken).\
> \- \*\*DRF authenticates once\*\* at request start; a token that\
> expires mid-stream does NOT abort the response.\
> \- \*\*Response is streamed\*\* — a downstream failure during\
> collection (timeout, disk read error) surfaces as a truncated\
> download, not as a clean \`500\`. Treat that case by inspecting\
> the broker's request-level logs.
```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Direct Public API (on-appliance)","version":"1.0.0"},"tags":[{"name":"logs","description":"Synchronous on-appliance log-bundle stream. Distinct from the\ntenant-side asynchronous flow under\n`broker-papi.yaml`'s `logs` tag — that one is request → poll →\ndownload against the cloud, this one is a single POST that streams\nthe bundle back as `application/octet-stream`.\n"}],"servers":[{"url":"https://{broker_host}","description":"The broker appliance's on-board HTTPS listener.","variables":{"broker_host":{"default":"broker.example.local","description":"Operator-chosen hostname or IP of the Broker VM appliance.\nReplace with your broker's actual address.\n"}}}],"security":[{"PublicApiToken":[]}],"components":{"securitySchemes":{"PublicApiToken":{"type":"http","scheme":"bearer","bearerFormat":"opaque","description":"Short-lived (10-minute TTL) opaque API token issued by\n[`generateToken`](#operation/generateToken). Sent as\n`Authorization: Bearer `. A token that expires mid-request\ndoes NOT abort the response (DRF authenticates once at request\nstart).\n"}},"responses":{"Unauthorized":{"description":"Missing, malformed, or expired Bearer token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicApiErrorResponse"}}}},"InitialPasswordRequired":{"description":"`InitialPasswordGateMiddleware` blocked the request because the\nfactory-default admin password has not yet been replaced via\n[`resetInitialPassword`](#operation/resetInitialPassword).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicApiErrorResponse"}}}}},"schemas":{"PublicApiErrorResponse":{"type":"object","description":"Canonical envelope for every error (`4xx`/`5xx`) JSON response.\n","required":["error"],"properties":{"error":{"type":"string","description":"Human-readable error message. Pydantic validation failures\nare rendered as `\": ; : ; ...\"`\n(semicolon-separated) by `format_pydantic_errors`.\n"},"reply":{"nullable":true,"description":"Always `null` on error responses. Present in the envelope to\nkeep the JSON shape consistent with success responses.\n"}}}}},"paths":{"/public_api/v1/logs":{"post":{"tags":["logs"],"operationId":"issueLogBundle","summary":"Stream the on-appliance log bundle","description":"Collect and stream the on-appliance log bundle back to the caller\nas `application/octet-stream` (a gzipped tar archive).\n\nThe collector is **single-writer**: only one bundle generation\nruns at a time. A concurrent call returns `503` with\n`Retry-After: 60`.\n\n- **Authentication:** Bearer token from [`generateToken`](#operation/generateToken).\n- **DRF authenticates once** at request start; a token that\n expires mid-stream does NOT abort the response.\n- **Response is streamed** — a downstream failure during\n collection (timeout, disk read error) surfaces as a truncated\n download, not as a clean `500`. Treat that case by inspecting\n the broker's request-level logs.\n","responses":{"200":{"description":"Gzipped tar archive of the on-appliance log bundle.","headers":{"Content-Disposition":{"description":"Attachment filename of the form\n`broker_log__.tar.gz`, where\n`device_id` is the broker's `PLATFORM_ID` (or\n`unknown` if not yet registered) and `timestamp` is\nrendered as `%b_%d_%Y_%H_%M_%S` (e.g.\n`May_17_2026_10_30_00`).\n","schema":{"type":"string"}}},"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary","description":"Raw bytes of the gzipped tar archive."}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/InitialPasswordRequired"},"500":{"description":"Synchronous startup failure (e.g., Redis read error from\n`build_bundle_filename`, or pre-stream audit log emission\nfailure). Streaming failures are NOT mapped to 500 — see\nthe operation description.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicApiErrorResponse"}}}},"503":{"description":"Another log collection is in progress; back off and retry.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicApiErrorResponse"}}}}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/local-log-bundle.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.