Logging Overview

xorlab writes its own local log files without any configuration. Everything beyond that is opt-in: no event is sent anywhere until you name it in a logging configuration file.

Connecting a SIEM?Start with Connect a SIEM. It covers which events are worth forwarding, which payload format to pick, and where to look in the documentation of Splunk, Microsoft Sentinel, QRadar, Elastic, and others — then sends you back here for the configuration.

Three decisions

Every logging configuration is the same three decisions, whichever channel you use:

Decision	Example
Which event should be recorded, and therefore which component’s configuration file you edit	`trace.msg_analysis.complete`, in `activeguard/core/`
Which channel carries it	Syslog, email, or a log file
Which format the payload uses	JSON, extended JSON, or CEF

Steps

Step	Description
How Logging Works	Recommended. Explanation of loggers, appenders, and why the configuration is split across components.
Choose What to Log	Mandatory. Pick the events and the payload format for what you want to achieve.
Forward Events over Syslog	Optional. Send events to a SIEM, a log collector, or any Syslog listener.
Send an Email When an Event Occurs	Optional. Get a mail for a low-volume event, such as a quarantine release request.
Write Events to a Log File	Optional. Write events to a rolling file on the xorlab host. On-premises deployments only.
Verify and Troubleshoot Logging	Mandatory. Confirm the events arrive, and work out why they do not.

Configuration Examples

Complete, copy-ready configuration files for the most common goals. Start here if you already know which event you want.

What xorlab logs without any configuration

Each component writes an audit log, an error log, and a verbose operational log to the local filesystem, rotated and size-capped. Those files exist whether or not you configure anything in this group. For on-premises deployments, Built-in Log Files explains how to configure the built-in logs and Operation Reference shows where they are located.

​Three decisions

​Steps

Configuration Examples

​What xorlab logs without any configuration

Three decisions

Steps

What xorlab logs without any configuration