---
title: Files, services, and logs
description: Where the scanner lives on each platform, what the services are called, and where to find logs.
---

## File locations

| | macOS | Linux | Windows |
| --- | --- | --- | --- |
| Binary | `/opt/surface/bin/surface` | `/usr/bin/surface` | `%ProgramData%\Surface\bin\surface.exe` |
| Data | `/var/lib/surface` | `/var/lib/surface` | `%ProgramData%\Surface` |
| Credentials | `/var/lib/surface/credentials.json` | `/var/lib/surface/credentials.json` | `%ProgramData%\Surface\credentials.json` |
| MDM setting | `/Library/Managed Preferences/com.superalign.surface.plist` | `/etc/surface/managed.conf` | `HKLM\SOFTWARE\Policies\Superalign\Surface` |
| Logs | `/var/lib/surface/logs/` | `/var/lib/surface/logs/` | `%ProgramData%\Surface\logs\` |
| Install log | `/var/log/surface-install.log` | `/var/log/surface-install.log` | `%ProgramData%\Surface\install.log` |
| Desktop app | `/Applications/Surface.app` | `/usr/bin/surface-ui` | `%ProgramData%\Surface\bin\SurfaceUI.exe` |

Credentials are readable only by the system account. The server keeps only a hash of the laptop's secret.

## Services

| Platform | Scanner | Tray |
| --- | --- | --- |
| macOS | LaunchDaemon `com.superalign.surface` | LaunchAgent `com.superalign.surface.tray` |
| Linux | systemd `surface.service` | Autostart `surface-tray.desktop` |
| Windows | Service `SurfaceScanner` | Scheduled task `SurfaceTray` |

Check the service:

**macOS**

```bash
sudo launchctl print system/com.superalign.surface
```

**Linux**

```bash
systemctl status surface.service
```

**Windows**

```powershell
Get-Service SurfaceScanner
```

## Logs

`sudo surface logs` reads the main log for you. The files:

| File | Contents |
| --- | --- |
| `surface.log` | The scanner. Capped at 200 MB or 30 days |
| `surface.error.log` | Crashes and output from the service manager |
| `tray.log` | The tray indicator |
| `extensions/<slug>.log` | One file per prompt collector |
| `update.log` | Self-update |

When you run `surface scan --once` by hand, output goes to the terminal, not the log file.

## The tray and the desktop app

The scanner installs a menu bar (macOS) or system tray (Windows, Linux) icon that runs as the signed-in person. It shows:

- The scanner version
- **Usage**: the person's own AI plan usage for Claude and OpenAI accounts signed in on this laptop. Shown here only, never sent to the console
- **My Device**: opens the desktop app, which shows this laptop's own page from the console
- **Account**: the signed-in email, or a prompt to run `surface init` if the sign-in expired
- **Status**: `active` when connected to the scanner

When a decision blocks or warns about a tool on this laptop, the tray shows a system notification titled **BLOCKED** or **WARNING** with the tool's name.

## Related

- [Configuration](/surface/scanner/configuration) for the settings and where to put them
- [Troubleshooting](/surface/scanner/troubleshooting) for what to check when a laptop is silent