Administration Account

Every Logship installation has one system-owned account for deployment-wide metrics and internal telemetry.

Property	Value
Account ID	`ffffffff-ffff-ffff-ffff-ffffffffffff`
Account name	`Logship Administration`
Owner	Logship itself
Authorized users	Users with `Logship.Global.Admin`

This identifier is part of Logship's storage and authorization contract. It is reserved permanently and must not be used for a tenant, test account, import target, or setup-provisioned account.

Lifecycle

The database creates the administration account automatically when the database connection starts. Startup also restores its canonical name if the row already exists under another name. No deployment configuration is required.

The account exists before internal metrics are accepted, so system metric schemas pass the same account-existence validation as tenant schemas. It is a real account rather than a virtual routing alias.

Logship protects the account at the database boundary:

ordinary account creation and update operations reject the reserved ID
the account cannot be deleted
user membership cannot be added to or removed from the account
the canonical account name is maintained by startup provisioning

These checks also apply to internal database RPC callers. Do not add the reserved ID to setupService.accounts; setup cannot claim or replace it.

The administration account is omitted from tenant account lists, tenant account counts, and per-account administration rollups. This prevents system-owned storage from appearing as a customer account or inflating tenant totals.

Access control

Access is based on the global permission Logship.Global.Admin, not on stored account-membership records.

Every global administrator receives access automatically when authorization is evaluated.
Non-global users are denied access, including account administrators.
A user cannot be invited to the administration account.
Removing a user's global-admin permission removes access without requiring account-membership cleanup.

The authorization rule is enforced on the account-scoped search endpoints used by the administration dashboard. The reserved account ID alone is not a credential and does not bypass authorization.

Metrics stored in the account

Deployment-wide metric producers write to the administration account. This includes:

logship.backend.admin.system, the periodic system administration rollup
runtime and service metrics emitted without a tenant-account context
logship.internal.Logs
internal activity and framework metrics produced by Logship's self-publishing metric listener
system messenger metrics that are not associated with a tenant account

Tenant-scoped telemetry remains in its tenant account. In particular, logship.backend.admin.account is written separately to each tenant account so that its account administrators can query their own time series without gaining access to system telemetry.

The distinction is:

Metric scope	Destination
Deployment-wide	Administration account
One tenant account	That tenant account
Per-account administration rollup	That tenant account

System rollup schema

logship.backend.admin.system is emitted periodically and is designed for time-series queries. Its current fields include:

Field	Description
`timestamp`	Rollup observation time.
`machine`	Host that emitted the rollup.
`account_count`	Number of tenant accounts; excludes the administration account.
`user_count`	Number of users.
`service_count`	Number of observed backend services.
`unhealthy_service_count`	Number of services currently reporting an unhealthy state.
`executor_count`	Number of observed search executors.
`executor_total_space_bytes`	Total storage capacity reported by search executors.
`executor_free_space_bytes`	Free storage capacity reported by search executors.
`executor_minimum_free_space_bytes`	Sum of the minimum-free-space reservations reported by search executors.

For example, a global administrator can query the latest system rollup through the reserved account:

POST /search/ffffffff-ffff-ffff-ffff-ffffffffffff/kusto
Authorization: Bearer <global-admin-token>
Content-Type: application/json

{
  "query": "logship.backend.admin.system | where timestamp > ago(1h) | order by timestamp desc | limit 1"
}

To chart storage availability over time:

logship.backend.admin.system
| where timestamp > ago(24h)
| project timestamp,
          used_bytes = executor_total_space_bytes - executor_free_space_bytes,
          free_bytes = executor_free_space_bytes
| order by timestamp asc
| render timechart

Tenant rollup schema

Each tenant account receives logship.backend.admin.account. Its current fields include:

Field	Description
`timestamp`	Rollup observation time.
`machine`	Host that emitted the rollup.
`schema_count`	Number of schemas in the account.
`storage_bytes`	Searchable and tracked storage attributed to the account.
`user_count`	Number of users with account membership.
`active_agent_count`	Number of agents associated with the account.
`pending_agent_count`	Number of agents waiting for account approval.
`latest_record_timestamp_ms`	Latest committed record timestamp, in Unix milliseconds.

Global administrators can query these schemas across the accounts they administer. Account administrators can query them only in accounts to which they have access.

Upgrade behavior

Logship does not rewrite historical metric files when the administration account is introduced. New deployment-wide metrics use the reserved account immediately after upgrade. Any older system metrics written under a previous account identifier remain in their original storage location until normal retention removes them or an operator migrates them explicitly.

Backups must include the administration account's schemas and files if historical system telemetry is required for recovery. On restore, Logship recreates the account row if necessary, but it cannot recreate historical metric data that was excluded from the backup.

Operational rules

Treat the all-f account ID as a platform constant, not configurable data.
Do not expose its schemas through account-admin roles or tenant tokens.
Do not include it when reporting billable tenant count or tenant storage.
Use the tenant account as the destination whenever a metric describes only that tenant.
Use the administration account only when a metric describes the deployment as a whole or has no tenant context.

If a global administrator can open the administration dashboard but system charts remain empty, verify that the collector and search executor services are enabled and that recent schemas exist under the reserved account. An authorization failure for a global administrator usually means the token does not contain Logship.Global.Admin; signing in again after a permission change refreshes the token.