You can control the logs of a device added as WMI in two different ways, through web interface or through CLI.
Web Interface Method:
Click Settings -> Integrations -> Data Collection to open the source list. Click the menu icon at the right of the source which you want to check and select Search. The Search page opens with today's logs of that source. The Search option is not shown when Leaf mode is enabled.
CLI Method:
You have to connect to Logsign Unified SecOps Platform with ssh. Follow the steps given below to see the source logs in the raw logs or the normalized logs.
Raw logs are written in the file with the gz extension which starts with collected.raw in the /opt/var/log folder. The file name follows the collected.raw.<hostname>@<pid>@<source>.<date>.gz pattern.
You can view raw logs with the command "zcat collected.raw.customer@1238@0.0.0.0.2019-11-13.gz". You can use a filter as shown below to view only the logs from a specific source.
Normalized logs are written in the same folder, in the files which start with collected.json. You can see the logs whose normalization process is completed as shown below.
WMI collection is handled by the logsign-poller-wmi service. You can follow its output in CLI with the command journalctl -u logsign-poller-wmi -f.
Error logs can be seen with description. There is a DCOM Session issue for the example below.
Authorizations of the authentication user should be checked in DCOM settings for fixing this issue.