# Log Review

Task-oriented recipes. Each section assumes you already have `splam` installed and running. See the [Tutorial](tutorial-getting-started.md) if not.


# Search the logs for a keyword

Open the **Logs** tab, set **Lines** to how far back you want to look, then type a term into **Search** (e.g. `error`, `fatal`, `denied`). The match is a case-insensitive substring check applied to the lines already fetched.

Searches don't requery `journalctl`, so widen **Lines** first if the term you want might be further back.


# Read highlighted keywords without searching

Some known keywords are colored inline as the log renders, so users can often spot what matters without typing a search term:

- error/failure terms (`error`, `failed`, `denied`, `fatal`, `invalid`, `dead`) in red

- in-progress terms (`warning`, `activating`, `deactivating`) in amber

- success terms (`ok`, `accepted`, `active (running)`, `success`/`successfully`) in cyan

- action terms (`start`/`started`/`starting`, `stop`/`stopped`/`stopping`, `restart`/`restarted`/`restarting`, `CRON`) in pink

To add your own keyword, see [Configure Highlighting](01.10-how-to-configure-highlighting.md).