Log archives and backups
CSP (Central Syslog) protects the logs of the subscription in two ways:
- the Log archive keeps the logs older than the searchable period, which are no longer on the Logs page;
- the Backups are safety copies of the subscription, to restore it if something goes wrong.
Archive and copies share the space of the backups of the plan. The page shows how much they take, for example "Space of the backups: copies 2 GB and log archive 5 GB, 7 GB of 50 GB".
The log archive
The plan sets how long the logs stay searchable on the Logs page. Every night the days that leave that period move to the archive, one file per day; a month archived in full becomes a single file.
The Log archive tile lists the archives, with the Period (Day or Month) and the number of Logs. In the archive the logs can no longer be searched from the panel: Download an archive to look at it or keep it elsewhere.
Opening an archive
An archive is a tar file compressed with zstd, with a CSV file for each day. It opens:
- on Linux, with
tar --zstd -xf <file>; - on Windows, with 7-Zip.
The CSV files open with a spreadsheet.
Deleting an archive
Delete removes an archive for good: its logs are no longer in the panel. Do it only after downloading it and keeping it elsewhere, for example to free space when the space of the backups is near its limit.
The backups of the subscription
The Backup tile holds the safety copies of this subscription. It works like the backup of the organization (see Configuration backups), but covers only this subscription:
- at the top, the Last copy with its outcome, the Next copy of the schedule and the space;
- Make a copy now makes one by hand, Schedule makes them by itself;
- a copy holds the Configuration (name, devices, plan and limits), the Searchable logs, or both;
- encryption, remote destinations, download and deletion are the same as in the backup of the organization.
Restore opens a guided page: the missing logs come back and, if you choose so, the configuration goes back to how it was in the copy.
Which one to use
| You need to | Use |
|---|---|
| Get back logs deleted by mistake, or put back a device removed | The backup of the subscription |
| Bring back users, roles and all the subscriptions together | The backup of the organization |
| Look at logs from many months ago | The log archive |
| Keep a copy outside the server of the panel | A remote destination in the schedule, or download the archives |
The space
Copies with logs take a lot of space. To stay within the limit:
- use incremental copies: after a full copy, the next ones hold only the new logs;
- keep a reasonable number of Copies to keep;
- send the copies to a remote destination: the remote space does not count in the limit.
When the space of the backups is near its limit or over it, the usage warnings arrive (see Subscriptions).