# Viewing Supabase Auth (GoTrue) Container Logs

How to open a shell on the private Supabase EC2 instance and inspect **auth** (GoTrue) container logs.

> Auth runtime logs are **not** in Studio. They live on the `auth` Docker service. Historical login/audit events also land in Postgres (`auth.audit_log_entries`).

## Production values (Datafy)

| Setting | Value |
|---------|-------|
| EC2 instance ID | `i-03d70f4349cdb8b93` |
| Region | `eu-west-1` (Ireland) |
| Compose project dir | `~/supabase-project` (or the path used on that host) |
| Auth service name | `auth` (image: GoTrue) |
| Public API | `https://supabase.datafy.co.za` |

---

## Step 1 — Log into the instance (SSM)

The instance has **no public IP / no SSH**. Use Session Manager from your **local** machine:

```powershell
aws ssm start-session `
  --profile <your-profile> `
  --target i-03d70f4349cdb8b93 `
  --region eu-west-1
```

Then switch to the app user and project directory:

```bash
sudo su - ubuntu
cd ~/supabase-project
```

> Full SSM prerequisites and troubleshooting: `docs/connect-private-ec2-ssm.md`.

---

## Step 2 — Confirm the auth container

```bash
sudo docker compose ps
```

Confirm `auth` is listed and healthy/running. If the service name differs on this host, use the name shown in `ps` for the commands below.

---

## Step 3 — View auth logs

```bash
# Follow live GoTrue logs (Ctrl+C to stop)
sudo docker compose logs -f auth

# Last N lines
sudo docker compose logs --tail=100 auth

# Timestamps included
sudo docker compose logs -f --timestamps auth
```

### Useful filters

```bash
# Errors, hooks, SMS / OTP
sudo docker compose logs --tail=200 auth | grep -iE 'error|hook|sms|otp|fail'

# Since a relative time (Docker Compose v2)
sudo docker compose logs --since=30m auth
sudo docker compose logs --since=2h auth | grep -iE 'error|hook'
```

---

## Auth logs vs audit log table

| What you need | Where to look |
|---------------|---------------|
| GoTrue process output (startup, DB connect, hook timeouts, HTTP errors) | `sudo docker compose logs … auth` |
| Historical auth events (sign-in, token refresh, etc.) | Postgres `auth.audit_log_entries` |

Example audit query (from EC2, with `psql` against RDS/Proxy — see `docs/supabase-aws-rds-proxy-setup.md`):

```sql
SELECT created_at, ip_address, payload
FROM auth.audit_log_entries
ORDER BY created_at DESC
LIMIT 50;
```

---

## Common checks

| Symptom | What to run |
|---------|-------------|
| Auth container restarting | `sudo docker compose ps` then `sudo docker compose logs --tail=100 auth` |
| Phone OTP / Send SMS hook | Filter for `hook` / `sms` — see `docs/supabase-auth-hook-send-sms-lambda.md` |
| DB / password / schema errors | Look for `permission denied`, `password authentication failed`, `invalid port` in auth logs |
| Confirm API is up | `curl -s https://supabase.datafy.co.za/auth/v1/settings -H "apikey: <ANON_KEY>"` |

Restart auth only when needed:

```bash
sudo docker compose up -d auth
sudo docker compose logs -f auth
```

---

## Quick reference

```powershell
# Local PC → EC2 shell
aws ssm start-session --profile <p> --target i-03d70f4349cdb8b93 --region eu-west-1
```

```bash
# On EC2
sudo su - ubuntu
cd ~/supabase-project
sudo docker compose logs -f auth
sudo docker compose logs --tail=200 auth | grep -iE 'error|hook|sms|otp'
```

---

## Related

- `docs/connect-private-ec2-ssm.md` — SSM shell and Studio port forwarding
- `docs/supabase-auth-hook-send-sms-lambda.md` — phone OTP hook debugging (includes log filters)
- `docs/supabase-aws-rds-proxy-setup.md` — stack setup; common Docker/auth issues
- `docs/migrate-supabase-cloud-to-self-hosted.md` — migration / cutover auth checks