Skip to content

Importing logs from files

When you start using CSP (Central Syslog), the logs of past years are often on another server: the old syslog server, a NAS, a folder of files. Import logs brings them into the subscription: once imported they are searched, analysed and archived like those received by the panel.

The Import logs button is on the Logs page of the subscription. You need a role that allows importing, and the plan of the subscription must allow it.

How it works

An import goes through four steps:

  1. you send the files;
  2. the panel reads them and shows the senders it found;
  3. you choose the device of each sender and the clock of its times;
  4. the panel writes the lines, in the queue.

The list of imports shows for each one When, the Files, the Lines, the Period and the Status: Waiting for the files, Reading the files, Waiting for your choices, In the queue, Importing, Imported, Failed or Taken away.

1. Sending the files

New import offers three ways:

Way When to use it
From this computer The files are on your computer. Send the files uploads them, showing the progress
From a server (SFTP) The files are on a server the panel can reach over SFTP: the panel downloads them from there, without going through your computer. It also needs the right CSP ยท Import old logs from a server (SFTP)
From addresses on the web (HTTPS) The files are published on a web server: write the addresses, one per line

From a server (SFTP)

Write Server, Port, User and Folder of the logs, and choose the Access:

  • With the key of the panel (recommended): the page shows the public key of the panel, to add to the user on the server (with Copy). No password leaves your hands, the key belongs to your organization only and you can remove it from the server whenever you want;
  • With the password of the user: it is used for this import only and then not kept.

With Connect, the panel shows the fingerprint of the server: check that it is the one of your server and confirm with Yes, it is my server. Then choose the files and Download and read the files chosen.

From addresses on the web (HTTPS)

HTTPS addresses only: the panel checks the certificate of the server and does not download from a server with a certificate that is not valid. If the server publishes the SHA-256 fingerprint of a file, write it after its address: a file that does not match is not imported.

For the Access you can choose None, User and password or Token: they are used for this import only and are not kept. Check the addresses checks that they answer; then Download and read the files.

2. What the files hold

The panel reads the files and shows What the files hold: how many lines, in how many files, from which day to which day, and The first lines, as the panel reads them. The lines in a format the panel does not read are counted and left out.

3. Your choices

For each Sender found in the files (an address or a name):

  • Device: the device of the subscription its lines go to, or Do not import;
  • Clock of the device: if the device wrote the local time without a time zone (a router on Italian time, for example), choose its time zone, and the times are read in it. As written in the file leaves the times as they are.

Also:

  • Leave out the lines containing: one text per line, regardless of upper and lower case. It is for leaving out useless debug messages;
  • Leave out the lines before: a day. It is for lines with a wrong time, such as those of a router just switched on with the clock on 1 January.

Import puts the import in the queue. When it is done, the Outcome says how many lines were imported and of which period.

Good to know

  • Each file once only: a file already imported in the subscription is refused, even with another name.
  • The space: the imported lines count in the space of the plan, not in the volume of the month.
  • No alerts: imported logs do not start event alerts.

Taking an import away

From the page of an import:

  • Take away the lines of this import removes the imported lines; the logs received by the panel stay;
  • Drop this import deletes the import and its files.

If an import Failed, nothing was written: correct the problem shown and start again with a new import.