You may delete logs as as long as they are not the current log being updated in <Geoevent install location>/data/log/ The current log is karaf.log. This is the log that the geoevent manager reads from and can only be deleted if you shut down geoevent. The other logs have will be karaf.log.1, karaf.log.2, etc. By default the logs are 1MB and there are 10 of them (log.1 ... log.10). The logs are constantly recycling as new logs are generated. You can get an idea of how fast logs are being recycled by comparing the timestamp of the most recent log and the oldest log file. The archived logfiles can be opened and searched in a text editor. Since karaf.log is opened and in use by geoevent it can only be read in manager. You may make a snapshot of the karaf.log using copy and paste.
If you set up a a developer configuration of geoevent, you read and manage the logs inside the karaf console. In a dev config you will have to set up some environmental variables and run geoevent as an admin from the command line. The developer guide in the sdk covers running geoevent fromm the command line. One of the advantages of running in dev mode is that you can use the logging commands in the console -- including log:display, log:clear, log:tail (displays the most recent log), etc. You can also use pipes and other terms to search the logs. For instance to search for error logs in the karaf console you could type
log:display | grep ERROR
at the command prompt.
Using some combination of manager, reading directly from logfiles, and reading from command line you can usually figure out most issues with geoevent.
