Understanding Logsign System Logs

Updated October 13, 2026 08:39

Introduction

This article will provide information about Logsign system logs.

Logsign System Logs

There are two different types of logs in Logsign: Logsign audit and Logsign health check. Both types are stored with the system DataType. They are distinguished by the Event.Type field: Health Check for health check logs and Audit for audit logs.

Logsign Health Check

Logsign has services for health checks, and Logsign health check logs are created when these services detect a critical condition.

DataType	Event.Category	Event.VendorID	Event.Status	Event.Action	Event.Note
system	EPS	100101	green	status ok	"Check EPS Average" defined in log sources EPS Average Checked. It reports that there is no problem in EPS Status.
	EPS	100102	yellow	increase	"Check EPS Average" defined in log sources Reports an increase in EPS Average. For the example above, the notification log will appear as follows. Overall EPS average increased by more than 50% in 5 minutes. Last week's average is 12.
	EPS	100103	yellow	decrease	"Check EPS Average" defined in log sources It informs us that there is a decrease in EPS Average. For the example above, the notification log will appear as follows. The overall EPS average fell more than 30% in 5 minutes. Last week's average is 12.
	Disk State	100201	green	size ok	Disk Size indicates that there is no problem in the use case and the available disk size information.
	Disk State	100202	red	limit exceed	The disk space usage limit is exceeded. Exceeding this limit causes logging to stop.
	Integration	100301	green	start	It is the status of successfully receiving logs at the source.
	Integration	100302	red	stop	It is the case of not receiving any logs during the Health Check period.
	Syslog Service	100401	green	status ok	It is the case that there is no problem in the syslog service. It is the status of logging with the syslog protocol.
	Syslog Service	100402	red	collection error	A situation where no logs are received from syslog resources within 5 minutes.
	Index	100501	green	start	It is the restart state of the ElasticSearch service.
	Index	100502	red	stop	It is the case where the ElasticSearch service is stopped.
	Persist	100601	green	status ok	Persist service logs are written to disk.
	Persist	100602	red	stop	It is the case that there is no change in the logs written by the Persist service within 5 minutes.
	Archived Data	100701	green	status ok	Archive is the state of having no problem in the file, directory size and current state.
	Archived Data	100702	red	folder error	The archive directory does not exist.
	Archived Data	100706	yellow	size error	Archive file sizes are smaller than expected.
	Archived Data	100707	red	file error	The archive directory exists but does not contain any files. The file may have been moved or deleted, or it was never created.
	Signed Data	100703	green	status ok	There is no problem in the current state of the signed file and directory.
	Signed Data	100704	yellow	size error	Signed file size is a problem.
	Signed Data	100705	red	folder error	The signed directory does not exist.
	Signed Data	100708	red	file error	The signed directory exists but does not contain any files. The file may have been moved or deleted, or it was never created.
	Stored Data	100801	yellow	file create	It is the new file state created in the archive or signed directory.
	Stored Data	100802	red	file modify	Archive or signed file update status.
	Stored Data	100803	yellow	file move	It is the archive or signed file transfer status.
	Stored Data	100804	red	file delete	Archive or signed file deletion status.
	Stored Data	100901	yellow	folder create	It is the case of creating a new folder in the archive or signed directory.
	Stored Data	100902	yellow	folder move	It is the case of moving a folder in an archive or signed directory.
	Stored Data	100903	red	folder delete	It is the case of deleting a folder in the archive or signed directory.

The table above lists the main health check records. Logsign also generates health check logs for other checks, for example CPU, RAM, Redis Server, Syslog Collector, Collection, Cluster Network, SSH Authentication, NTP and Data Transfer. To examine these logs, filter the query below by the Event.Category field.

You can examine the above logs with the following query.

DataType:"system" AND Event.Type:"Health Check"

For Logsign Health Check notifications, you need to activate the following alarms and configure the action rule for notifications.

Logsign Audits

Audit logging is available for movements performed in the Logsign user interface. You can examine the contents of these audit logs in the table below.

DataType	Event.Type	Event.Category	Event.VendorID	Event.SubCategory	EventMap.SubType	Event.Action	Event.Info
system	Audit	User	200101	User Login Operation	Login	login	User has logged in
			200102	User Login Operation	Logout	logout	User logged out
			200103	User Login Operation	Deny	login fail	User has failed login
			200201	User Profile	Add	create	User profile created
			200202	User Profile	Change	update	User profile updated
			200203	User Profile	Delete	delete	User profile deleted
			200301	System User	Add	create	New system user created
			200302	System User	Change	password change	System user password changed
			200303	System User	Delete	delete	System user deleted
			200401	GUI User	Add	create	GUI user created
			200402	GUI User	Update	modify	GUI user updated
			200403	GUI User	Delete	delete	GUI user deleted
			200404	GUI User	Change	change	MFA settings changed
			200405	GUI User	Update	reset	MFA settings reset
			200406	LDAP User	Add	set	LDAP user set
		Alert	200501	New Alert	Create	create	New alert created
			200502	Existing Alert	Update	update	Existing alert updated
			200503	Existing Alert	Delete	delete	Existing alert deleted
			200504	Alert Block	Create	create	New alert block created
			200505	Alert Block	Update	update	Alert block updated
			200506	Alert Block	Delete	delete	Alert block deleted
			200507	Sigma Import	Create	import	Sigma rule imported
			200508	Sigma Bulk Import	Create	import	Sigma rules bulk imported
			200509	Sigma Field Mapping	Create	create	Sigma field mapping created
			200510	Sigma Field Mapping	Delete	delete	Sigma field mapping deleted
			202201	Existing Alert	Apply	enable	An Alert enabled
			202202	Existing Alert	Apply	disable	An Alert disabled
		Bucket	200601	New Bucket	Create	create	New bucket created
			200602	Existing Bucket	Update	update	Existing bucket updated
			200603	Existing Bucket	Delete	delete	Existing bucket deleted
		Dashboard	200701	Welcome Dashboard	Apply	set	Welcome dashboard set
			200702	New Dashboard	Create	create	New dashboard added
			200703	Existing Dashboard	Update	update	Dashboard updated
			200704	Existing Dashboard	Delete	delete	Dashboard deleted
			200711	Dashboard Category	Create	create	New dashboard category created
			200712	Dashboard Category	Update	update	Dashboard category updated
			200713	Dashboard Category	Delete	delete	Dashboard category deleted
			200721	Dashboard Widget	Create	create	New dashboard widget created
			200722	Dashboard Widget	Update	update	Dashboard widget updated
			200723	Dashboard Widget	Delete	delete	Dashboard widget deleted
		Report	200801	Scheduled Report	Create	create	New scheduled report created
			200802	Scheduled Report	Update	update	Scheduled report updated
			200803	Scheduled Report	Delete	delete	Scheduled report deleted
			200811	Offline Report	Create	create	Offline report created
			200812	Offline Report	Delete	delete	Offline report deleted
			200821	Online Report	Create	create	Online report created
			200822	Online Report	Update	update	Online report updated
			200823	Online Report	Delete	delete	Online report deleted
			200831	Report Block	Create	create	Report block created
			200832	Report Block	Delete	delete	Report block deleted
			200833	Predefined Report	Apply	install	Report block installed from predefined reports
			200841	Data Export	Share	create	Data export created
			200842	Data Export	Delete	delete	Data export deleted
			200843	Data Export	Share	send	Send exported report
		System	200901	Resource	Create	create	New resource created
			200902	Resource	Update	update	Resource settings updated
			200903	Resource	Delete	delete	Resource deleted
			200904	Resource	Delete	delete	All selected resources deleted
			200913	Resource	Apply	enable	All selected resources enabled
			200914	Resource	Apply	disable	All selected resources disabled
			201001	Data Policy	Create	create	Data policy created
			201002	Data Policy	Change	update	Data policy updated
			201003	Data Policy	Info	delete	Data policy deleted
			201004	Data Policy	Apply	apply	Data policy applied
201101	Mini Query		Create	create	Mini query created
201102	Mini Query		Update	update	Mini query updated
201103	Mini Query		Delete	delete	Mini query deleted
201201	Sign Settings		Update	update	System sign settings updated
201202	Sign Settings		Apply	validate	Signed log file validated
201301	Index		Delete	delete	Index deleted
201302	Archive Log		Delete	delete	Archive log file deleted
201303	Signed Log		Delete	delete	Signed log file deleted
201401	Update		Info	check	Update manager checked
201402	Update		Info	update	Initiate Update
201501	Remote Support		Start	start	Remote support started
201502	Remote Support		Stop	stop	Remote support stopped
201601	FieldSet		Apply	apply	Default fieldset applied
201602	FieldSet		Create	create	Fieldset created
201603	FieldSet		Update	update	Fieldset updated
201604	FieldSet		Delete	delete	Fieldset deleted
201701	License		Info	add	License activate attempt
201702	License		Info	synchronize	License synchronization
201801	Company Information		Info	update	Company informations updated
201802	Company Information		Info	load	Default logo loaded
201803	Company Information		Info	import	New logo imported
202001	Action Rule		Create	create	Action rule created
202002	Action Rule		Update	update	Action rule updated
202003	Action Rule		Delete	delete	Action rule deleted
202101	Response Integration		Create	create	Response Integration configured
202102	Response Integration		Update	update	Response Integration configuration updated
202103	Response Integration		Delete	delete	Response Integration configuration deleted
202104	Certificate		Change	certificate change	Ui certificate uploaded
Network	201901	Interface	Info	update	Update network settings

Some audit records (for example configuration backup, custom plugin and data retention operations) are generated with Event.VendorID 1. To examine them, filter by the Event.Category and Event.SubCategory fields.

You can examine the above logs with the following query.

DataType:"system" AND Event.Type:"Audit"

Introduction

Logsign System Logs

Logsign Health Check

Logsign Audits

Articles in this section