SolarWinds Observability SaaS offers requested features to extend beyond log aggregation into full-stack visibility across applications, services, cloud and hybrid infrastructures, and databases. SolarWinds Observability is built around the Papertrail event viewer with matched event search speed and ease of search as Papertrail, while also connecting data points across the stack to deliver operational intelligence and business insights.

Migration Process

When your Papertrail account is ready for migration, you'll see a new button in the top right corner that says Migrate to SolarWinds Observability.

For customers currently undergoing forced migration, the deadline for migrating your account is September 29, 2025 at 11:59 PM PST. If you have not migrated to SolarWinds Observability SaaS by that time, you will be force-migrated or lose access to Papertrail.

After migration, your Papertrail account will be in read-only mode. You will still be able to access some historical information, however, core features, such as logs and alerts, will only be accessible in SolarWinds Observability SaaS. Your Papertrail instances will remain accessible for several weeks, but they will eventually be shut down.

Billing

When transitioning to SolarWinds Observability SaaS, your plan information and billing data will be available in the SolarWinds Customer Service Portal, meaning you will be able to manage your plan and billing within the new platform immediately. Your invoices are stored in the Customer Portal. In the meantime, you can email customerservice@solarwinds.com with any billing-related questions.

Your price for log management is not changing. During this migration, SolarWinds will handle the collection and submission of sales tax. This will now be included in your billing as you transition to the new system. If your organization is exempt from sales tax, provide your exemption certificate to salestax@solarwinds.com.

Authentication

Your existing Papertrail account authentication settings (password and MFA) will be preserved during the transition and available for use in SolarWinds Observability SaaS.There is a Coming from Papertrail button on the SolarWinds Observability SaaS login form for your convenience. If you are having trouble logging into the Customer Portal, reach out to our team at customerservice@solarwinds.com.

Log Volume

The syslog volume data is calculated the same way it was in Papertrail. The volume is equal to the message payload, plus 50 bytes for any header data.

To purchase more log volume, select the Manage Your Plan button in the top ribbon.

Archives

New archives will be created in SolarWinds Observability SaaS in a JSON-formatted file. Learn more at Log archiving.

You have a grace period to retrieve your previous archives from Papertrail. If you need more time or have questions, contact us at customerservice@solarwinds.com.

Automatic S3 archive export

In SolarWinds Observability SaaS, you will still be able to archive your log messages to your own S3 bucket. After creating an Amazon Web Services account at https://aws.amazon.com and activating Amazon S3, create a bucket for log archives, and share write-only access with SolarWinds Observability SaaS. For more information on creating buckets, see Creating, configuring, and working with Amazon S3 buckets in the Amazon documentation. For the bucket you are creating, use the following information:

• Use a unique Bucket Name, such as companyname-papertrail. The name should consist solely of lowercase letters, numbers, and hyphens. For more information, see General purpose bucket quotas, limitations, and restrictions in the Amazon documentation.

• Assign the bucket to the appropriate region.

• When setting permissions, add access to another AWS account. Add the user 4b0a516d33d6b490d119301a4b16db3fa49a6b33bdc5135c2ab90e8184f6995f with Write access enabled for Objects.

Changes can also be made at a later time by selecting the bucket and choosing the Permissions tab.

After submission, Amazon's management console will change the username to aws. This is expected.

Once the bucket has been created and configured through AWS, you can enable archiving in SolarWinds Observability SaaS. Under Settings > Logs > Log archives, enable the Amazon S3 toggle, then enter the S3 Bucket Name and S3 Bucket Path.

After setting up S3 archiving, it takes approximately 6 to 7 hours for logs to be available in the archive.

S3 export via IAM

Access can also be controlled with a bucket policy. The following sample policy permits SolarWinds Observability SaaS to upload archives:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PapertrailLogArchive",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::719734659904:root"
        ]
      },
      "Action": [
        "s3:DeleteObject",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::bucket-name/papertrail/logs/*"
      ]
    }
  ]
}

Here, bucket-name/papertrail/logs/ is the directory for SolarWinds Observability SaaS. The s3:DeleteObject action isn't strictly necessary. It is only used to clean up the temporary test_file.txt during the initial configuration.

Under Settings > Archives, enable S3 archive copies and provide the S3 bucket name. A test upload will be performed when saving the bucket name, but the test file will be deleted. Please note, it may sometimes take several hours for a new bucket to become available, due to DNS propagation delays.

When archives are uploaded to the bucket, each file is named under the path (key prefix) provided to SolarWinds Observability SaaS, typically papertrail/logs/<xxx> where <xxx> is an ID. For example, an archive file for 3 PM UTC created on February 25, 2019 would be bucket-name/papertrail/logs/54321/dt=2019-02-25/2019-02-25-03.tsv.gz. Days are from midnight to midnight UTC.

Alerts

Some alert types currently available in Papertrail are not supported in SolarWinds Observability SaaS. This only concerns alerts migrated from Papertrail. Alerts created in SolarWinds Observability SaaS are not affected.

SolarWinds Observability SaaS does not support the following Papertrail alert types:

• Cloudwatch

• Datadog

• Geckoboard

• Hosted Graphite

• AppOptics

• Boundary

• HipChat

• Librato

• StatHat

• VictorOps (Splunk On-Call)

• Count-only Webhooks

If you currently rely on one of these alert types, review your current alert configurations and test whether the standard SolarWinds Observability SaaS webhooks can be used with alert types labeled as not supported. There are currently no additional steps available to mitigate or adjust for this change.

Slack notifications

When a new Slack notification configuration is created in SolarWinds Observability SaaS, a Log Group is assigned silently in the background. To ensure the Slack configuration can be assigned to the correct Alert, users can edit the configuration after to creation to select the correct Log Group(s).

Missing Papertrail features

Not all features from Papertrail have been carried over to SolarWinds Observability SaaS with identical functionality. However, the new platform has significant advantages over the previous one: We have an AIOps engine, and we plan to engage that service to improve logging features. If there's anything missing that is a big gap for you and your team, let us know via the Give Feedback option in the help menu. Our product team is ready to collect your feedback and engage with you.

Adding logs

To add more logs in SolarWinds Observability SaaS, click the Add data button in the upper-right corner. Follow the prompt for creating a Log destination in SolarWinds Observability SaaS, which can be used to send data to either a syslog or HTTPS endpoint. Test a destination by using curl to send data and ensure it appears in your log viewer. Usage guidance can be found by navigating to Logs > Destinations > Select a destination > View usage.

Log destinations

In SolarWinds Observability SaaS, you can add a new log destination or update your previous ones to account for changes you need to make for your syslog servers and other sources. Using SolarWinds Observability SaaS, you can create log destinations for systems that send logs either via HTTPS or via TCP/UDP in a traditional syslog setup. The connection method is configured when creating a new destination. To create a log destination, go to Logs > Destinations > Create destination.

Two types of connections are available in the Create destination wizard:

• Token-based: A token-based destination accepts logs sent via HTTPS. These destinations use a provided token for the authentication of POST requests when sending events and can accept single or newline delimited events.

• Port-based: A port-based destination accepts logs sent to a dedicated host/port using the syslog protocol. Every created destination appears on the list in the Destinations tab. You can click the destination's name to open its details, view the token, or change the destination's description.

Saving logs in SolarWinds Observability SaaS

Log archives in SolarWinds Observability SaaS are saved to a JSON-formatted file, which is then compressed to GNU zipped archive, as opposed to a .tsv format in Papertrail.

API differences between Papertrail and SolarWinds Observability SaaS

The following examples show the syntax of some basic API calls in SolarWinds Observability SaaS:

Last 100 events
curl -X 'GET' \
'https://api.na-01.cloud.solarwinds.com/v1/logs?pageSize=100' \
-H 'accept: application/json' \
-H 'Authorization: Bearer {TOKEN}' \

Query for "payload"
curl -X 'GET' \
'https://api.na-01.cloud.solarwinds.com/v1/logs?filter=payload&pageSize=100' \
-H 'accept: application/json' \
-H 'Authorization: Bearer {TOKEN}' \

Query for data between 12:00am and 12:02am on July 02
curl -X 'GET' \
'https://api.na-01.cloud.solarwinds.com/v1/logs?startTime=2024-07-02T00%3A00%3A00Z&endTime=2024-07-02T00%3A02%3A00Z&pageSize=100' \
-H 'accept: application/json' \
-H 'Authorization: Bearer {TOKEN}' \

In SolarWinds Papertrail, the calls would be constructed as follows:

Last 1000 events
curl -v -H "X-Papertrail-Token: {TOKEN}" https://papertrailapp.com/api/v1/events/search.json

Query for "error"
curl -v -H "X-Papertrail-Token: {TOKEN}" https://papertrailapp.com/api/v1/events/search.json?q=error

SeeSolarWinds Observability SaaS REST API for more information on API and accessing the Swagger documentation.

For users who migrate from Papertrail to SolarWinds Observability SaaS, the Papertrail API will continue to work, with some conditions:

• The Papertrail API is unable to manage users in SolarWinds Observability SaaS. User management calls will return an HTTP 405 error. This applies to any script that would access https://papertrailapp.com/api/v1/users.json.

• System creation via the API is not immediate. It may take a few moments for the new system to be accessible through subsequent API calls.

• After migration, you can no longer refresh a token in Papertrail. Doing so will break the connection to the migrated org for the API calls.

• Once your account has been migrated to SolarWinds Observability SaaS, the API calls to the Papertrail endpoint are only available to users hosted in the United States.

Differences in SolarWinds Observability SaaS search and Papertrail search

Search queries in SolarWinds Observability SaaS that are not wrapped in quotes result in terms that contain the query. Search queries wrapped in quotes result in exact matches, aside from the following exceptions, which always use the "contains" matching:

• Sender

• Severity

• Message

• Facility

json.key:value searches behave the same in SolarWinds Observability SaaS and Papertrail.

All searches with a key:value syntax are considered key-value searches.

SolarWinds is migrating all Heroku users from the Papertrail platform to the SolarWinds Observability SaaS platform. Users who employ certain alert types need to be aware of upcoming changes, as some alert types currently available in Papertrail are not supported in SolarWinds Observability SaaS.

The following Papertrail alert types are fully supported in SolarWinds Observability SaaS:

• Email

• New Relic

• PagerDuty

• Pushover

• Slack

• SNS

• Zapier

• Regular Webhooks

The following Papertrail alert types are not supported in SolarWinds Observability SaaS:

• Cloudwatch

• Datadog

• Geckoboard

• Hosted Graphite

• AppOptics

• Librato

• StatHat

• VictorOps (Splunk On-Call)

• Count-only Webhooks

API differences

Heroku users who have migrated from Papertrail to SolarWinds Observability SaaS will experience failure of API calls if they continue to use the Papertrail API. Users will need to migrate to SolarWinds Observability Agent APIs.

To understand the key differences, see API differences between Papertrail and SolarWinds Observability SaaS. An overview of API in SolarWinds Observability SaaS is available at SolarWinds Observability SaaS REST API.