root@wireguard:/etc/wireguard/wgctl# wc -l /etc/wireguard/wgctl/commands/logs.command.sh
sed -n '1,50p' /etc/wireguard/wgctl/commands/logs.command.sh
629 /etc/wireguard/wgctl/commands/logs.command.sh
#!/usr/bin/env bash

FW_EVENTS_LOG="$(ctx::fw_events_log)"
WG_EVENTS_LOG="$(ctx::events_log)"

function cmd::logs::on_load() {
  flag::register --name
  flag::register --type
  flag::register --since
  flag::register --limit
  flag::register --fw
  flag::register --wg
  flag::register --follow
  flag::register --merged
  flag::register --all
  flag::register --before
  flag::register --force
  flag::register --days
  flag::register --raw
  flag::register --detailed
  flag::register --service
  flag::register --event
  flag::register --ascending
  flag::register --descending
  flag::register --resolved

  flag::exclusive --ascending --descending
}

function cmd::logs::help() {
  cat <<EOF
Usage: wgctl logs [subcommand] [options]
 
Show or manage WireGuard and firewall activity logs.
 
Subcommands:
  show (default)    Show activity logs
  clean             Remove keepalive handshakes (deduplicate)
  remove, rm        Remove log entries
  rotate            Remove entries older than N days
 
Options for show:
  --name <name>         Filter by client name
  --type <type>         Filter by device type
  --limit <n>           Max results per source (default: 50)
  --since <time>        Show events since: 2h, 7d, 23/05, 23/05/2026, 2026-05-23
  --service <svc>       Filter by service name, IP, or IP:port
                        e.g. pihole, proxmox:web-ui, 10.0.0.100, 10.0.0.100:8006
  --event <type>        Filter wg events: attempt | handshake
  --fw                  Show only firewall drops