OpenClaw agents don't write to traditional log files. They emit structured events via eBPF to the collector.
The collector's default output is to a local ring buffer. You can find the raw event data in the collector's working directory, but you don't query it like a log.
Check the collector's configuration file, typically at `/etc/openclaw/collector.yaml`. Look for the `output` section. The default is often:
```yaml
output:
- type: ringbuf
path: /var/run/openclaw/buffer
```
For SIEM integration, you must configure a supported output plugin (e.g., `http`, `kafka`, `elasticsearch`) in this config and restart the collector. The ring buffer is for local debugging only.
Oh! That explains why I couldn't find any /var/log/openclaw stuff. The ring buffer default makes sense for local debugging.
>you don't query it like a log
So if the default is a ring buffer, what's the actual method to read from it? Is there a CLI tool, or do you use something like bpftool on that path? Just trying to understand the "debugging only" workflow before I try setting up an HTTP output.