Write Events to a Log File

Prerequisites

Know which event and which format you want: Choose What to Log
On-premises deployments only. There is no filesystem access on a xorlab-hosted deployment, so use Forward Events over Syslog there instead.

This is separate from the log files xorlab writes anyway — those are described in Built-in Log Files and need no configuration.

Configure the appender

In the Expert Editor, go to the directory of the container that emits your event, listed in How Logging Works.
Open logback-audit.xml, or create it if it does not exist yet.

Add the appender and the logger:

xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
    <appender name="rollingFileAppender" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${log_dir}/mylogfile.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>${log_dir}/mylogfile-%d{yyyy-MM-dd}.%i.log.zip</fileNamePattern>
            <maxFileSize>10MB</maxFileSize>
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss} - %jsonMsg%n</pattern>
        </encoder>
    </appender>

    <!-- Change the name to the event you chose -->
    <logger name="audit">
        <appender-ref ref="rollingFileAppender"/>
    </logger>
</included>

Set file and fileNamePattern to the file name you want. ${log_dir} resolves to that component’s own log directory on the host, under /var/log/xorlab/ — see Operation Reference.
Set the rolling policy. maxFileSize caps one file, maxHistory the number of rolled files kept, and totalSizeCap the compressed total. Set a bound you can afford. A file appender on a per-email event fills a disk quickly, and nothing else on the host trims it for you.
Set logger name to the event you chose.
Set pattern to the format you chose. The alternatives are in Format Converters.
Click Publish. The logging configuration becomes active within about one minute.
Trigger the event and confirm the file appears: Verify and Troubleshoot Logging.

One event can go to a file and to a SIEM at once — declare both appenders and reference both from the same logger. There is a worked example in Log threat intelligence.

​Configure the appender

Configure the appender