Skip to content

Searching and reading the logs

The Logs tile of a CSP (Central Syslog) subscription shows the logs received, the most recent first, and lets you search and download them. Without filters the page shows the last 24 hours.

Searching

The filters are at the top of the page:

Filter What it does
From and To The period
Device The name or the address of the device
Category Errors, Warnings, Information, or All
Facility The syslog facility, for example auth for the sign ins
Text A word or a phrase of the message

Search applies the filters, Last 24 hours removes them. Newer and Older move through the results.

For each log the page shows Received (the time the panel received it, in your time zone), the Device, the Severity and the Message. The Device column shows first the name the device writes in its logs, then the name you gave it and its address.

The time of reception is the one the logs are searched and sorted by: it is always right, even if the clock of a device is wrong.

The fields of the event

The Esapanel agents, and the devices that send syslog RFC 5424 with structured data, give each log fields of its own: for example User, Source address, Event (on Windows, 4625 is a failed sign in) and Outcome.

  • Details, under a log, shows its fields.
  • A click on a user or an address (Show only the logs with this value) shows only the logs with that value.
  • In Fields of the event you can search by exact value: all the failed sign ins of a user, or everything a source address did. The user is compared without telling upper and lower case apart.

Example: who tried to get into a Windows server

  1. Filter the Device with the name of the server.
  2. In Fields of the event, write 4625 in Event.
  3. The result is the failed sign ins. Open Details on one of them and click the Source address to see everything that address did.

Interruptions of the reception

A yellow row marks an interruption of the reception of the server of the panel, for example during a restart: the logs your devices sent over UDP in that interval did not arrive. The logs sent over TCP, or by the agent, are usually sent again by the device.

The names of the addresses

If your plan includes it, the panel looks up in the DNS the names of the public addresses that appear in the logs, for example those of an attacker in the logs of a firewall, and shows them in brackets after the address. The most recent logs may not have their names yet. The option is off unless asked for, because whoever runs the DNS of an address can see that it was looked up.

Downloading

Download saves the logs found with the current filters, as CSV for a spreadsheet or as syslog text. A download holds at most a fixed number of logs: for a long period, download in parts, for example one month at a time. The downloads hold the logs as they arrived, without the names of the addresses.

To download you need a role that allows it (CSP ยท Export logs).

Where the older logs are

The plan sets how long the logs stay searchable on this page. The older logs are not lost: every night they move to the Log archive tile, where you download them (see Log archives and backups).

Alert me if it repeats

On a log, Alert me if it repeats opens the form of a new alert rule already filled in with the text of that log: it is the quickest way to be told when a message shows up again (see Event alerts).