Before You Begin

​

Choose log event

1. Visit the Log Events page
2. Choose the event that should be logged. Common ones are Audit events or SMTP events.
3. Take note of the Event Name and Container of the chosen event.
4. In the Expert Editor, navigate to the right directory based on Container:

   Container	Directory
   Core	activeguard/core/
   Mta	activeguard/mta/audit/
   Backend	xcc/backend/
   Auth	auth/auth/
   Dana	/etc/xorlab/dana/default/ - Modify configurations via ssh

5. Create the file logback-audit.xml if it does not exist and add:
   logback-audit.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <included>
   <!-- add <appender> elements on top -->
   <!-- add <logger> elements below -->
   </included>
   
6. Click Publish. The logging configuration becomes active within about one minute.

​

Choose log format

<appender>
    <encoder>
        <pattern>%jsonMsg%n</pattern>
    </encoder>
</appender>

<appender>
    <encoder>
        <pattern>%coreJsonMsg%n</pattern>
    </encoder>
</appender>

<appender>
    <encoder>
        <pattern>%cef%n</pattern>
    </encoder>
</appender>