Logs¶
The Logs module presents the timestamped history of the events recorded by the platform: console and portal sign-ins, application launches and closures, management actions on configuration objects, events related to the Edge Gateways and to the Bastion client. It is aimed at an administrator who wants to review, filter or export those traces as part of an audit or an investigation.
Log cleanup is driven from the Log data cleanup module.
Reading the grid¶
Each row describes an event, across three columns.
| Column | Description |
|---|---|
| Date/Origin | Date and time of the event, adjusted to the browser time zone, then the user name, their authentication domain and the IP address of the client workstation. Failing a client address, the Edge Gateway's is displayed. |
| Description | Label describing the event. |
| Information | Technical context, depending on the event: site and name of the application involved, browser (with its icon), operating system, Edge Gateway name and version, Bastion client version. |
A colour band, on the left of the row, recalls the nature of the action:
| Colour | Nature of the action |
|---|---|
| Sky blue | Add an item. |
| Orange | Modify an item. |
| Red | Delete an item. |
| Bright blue | Action on a password. |
| Grey | Any other action. |
Guest sessions
For sessions opened by a third-party guest, the domain is displayed in italics as Guests.
When the list is empty, the grid displays No logs. It is paginated (15, 25 or 50 rows per page) and the refresh button of the pagination bar reloads it.
Filters¶
The Filters panel is collapsed by default. It offers four mutually exclusive search modes: acting on the fields of one mode automatically selects its radio button and resets the others.
Default mode. No restriction on the event type.
Filters object-management and session-control events, through two groups of checkboxes.
| Group | Checkboxes offered |
|---|---|
| Action Type | Add, Modify, Delete. |
| Sessions | Close, Pause, Resume. |
Ticking one checkbox in either group is enough to activate this mode. Ticking none amounts to keeping every action of both groups.
Filters by type of usage event. Ten checkboxes are offered: Administration Console connections, Web portal connections, Applications launching, Applications closing, Gateways, HTML5 Gateways, User plugin, Direct sessions launching, Direct sessions closing, Actions on passwords.
As with the previous mode, ticking none amounts to keeping all ten types.
Free substring search in the event description. The mode activates as soon as the field takes the focus.
The Date checkbox brackets the selected mode with an interval, without being exclusive of it.
| Field | Description |
|---|---|
| Starting date | Lower bound of the interval, formatted DD/MM/YYYY. Cannot be later than the current date. |
| Ending date | Upper bound. Can be neither earlier than the starting date nor later than the current date; the interface shifts it automatically if the starting date passes it. |
Changing either date ticks Date automatically.
The Display button applies the filters, reloads the first page and collapses the panel. The Reset button restores the form to its default state and replays the search.
Once collapsed, the panel is titled Current filter followed by the selected mode, the ticked labels and, where applicable, the date interval.
CSV export¶
The Export all pages button downloads every event matching the current filters as a logs_export.csv file, whose fields are separated by semicolons.
The file starts with a header: Organization followed by its name, then — if the Date filter is active — a blank line and the requested interval, then Exportation date followed by the export timestamp, and two blank lines. The column headings come next:
| Column | Data |
|---|---|
| Date | Date and time of the event. |
| Domain | Authentication domain of the user. |
| User | Account behind the event. |
| IP | IP address of the client workstation. |
| Description | Label of the event. |
| Browser | Browser used. |
| OS | Operating system of the client workstation. |
Three columns only appear when they are of use
When the export contains at least one gateway or Bastion client event, three extra columns are added: Name (Edge Gateway name), Version (Edge Gateway or Bastion client version) and IP address(es) (Edge Gateway address). Without such events those columns are absent from the file — two exports may therefore not have the same width.
The number of exported rows is capped by a platform-level limit.