When you add a source with the SMB protocol, you can control the logs through web interface or CLI. Controlling logs from the web interface is an easier process.
Web Interface Method:
Using the Search menu in Logsign Unified SecOps Platform web interface, you can search the source logs by typing the source name or IP address.
As an example, you can use Source.IP:"192.168.1.80" EventSource.Product:"IIS" queries.
CLI Method:
You have to connect to Logsign Unified SecOps Platform with ssh to check the logs via CLI. Follow the steps given below to check the source logs which is added with the SMB protocol.
You can see the source logs in the raw logs or in the normalized logs.
Raw logs of the current day are written in the /opt/var/log folder, in files named collected.raw.<hostname>@<pid>@<group>.<YYYY-MM-DD>.gz. Here <hostname> is the host name of the Logsign server, <pid> is the ID of the process that writes the file, and <group> is 0.0.0.0 unless the source is assigned to a persist group. The gz extension is used when the compression format is gzip, which is the default in Settings > Data Management > Data Retention.
Raw logs are written only for sources where Raw Persist Enabled is selected (it is selected by default). You can check this option by editing the source under Settings > Integrations > Data Collection.
You can view raw logs with the command "zcat collected.raw.customer@1238@0.0.0.0.2019-11-13.gz". In this example, customer is the host name of the Logsign server. You can use a filter as shown below to view only the logs from a specific source.
Normalized logs are written in the same folder, in files that start with collected.json. and follow the same naming pattern. You can see the logs whose normalization process is completed as shown below.
Files from previous days are moved out of /opt/var/log by the daily maintenance job. Raw log files are moved to /opt/var/log/signed/<YYYY>/<MM>/<DD>/ and renamed in the <YYYY-MM-DD>.<group>@<hostname>@<pid>.collected.raw.gz format, for example 2019-11-13.0.0.0.0@customer@1238.collected.raw.gz. You can read these files with the same zcat command.