Two streams, deliberately separate: the audit chain is what the CA did; the operational log is how the software ran. When capturing evidence, know exactly what each view shows.
The console's log view reads a rolling 2,000-entry in-memory ring per process, and the caveats are stated on screen: "three errors" means three are still in the buffer, not that three happened. Level and Role filters are applied by the server over the whole ring; Message and Detail filter only the lines already fetched in your browser — so a line visible in docker logs that a Message chip cannot find needs the Level lowered first, to pull it into the window.
There is deliberately no CSV export and no time filter — a file built in the browser would look like the logs when it is one process's tail. The export is curl -s .../v1/logs?level=error | jq; full stdout is docker compose logs <service>, shipped to your log platform like any container's.
The thread tying it together: every request carries an X-Request-Id. Capture it with the exact refusal — it correlates the console, the ops stream and the support conversation.
Now I can capture evidence that outlives the ring buffer.