Log monitoring

The NDR Series appliance includes commands to monitor the system. You can monitor NDR-specific logs and manage processes in KLISH. Shell access is not required to access logs.

The following logs are available:

Log Name	Description
auth	Displays an auth log of the system.
system	Displays a system log (npulse.log).
message	Displays logs from /var/log/messages.
elasticsearch	Displays an elasticsearch log for all the elastic nodes.
nginx	Displays logs for access and error from /var/log/ngingx.
audit	Displays audit logs from /var/log/audit.

Accessing logs

To access the NDR Series appliance logs:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the log you want to view:
npadmin@ia(config) # show log
For example,
npadmin@ia(config) # show log elasticsearch
The log appears. Press q at anytime to exit from the log

Streaming logs and viewing historic logs

The following commands are available to stream and view historic logs:

Command	Description
`continuous`	Streams the selected log.
`history`	Displays all historic logs stored on the NDR for the selected log.

To continuously stream a log:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the log you want to stream:
npadmin@ia(config) # show log continuous
For example:
npadmin@ia(config) # show log elasticsearch continuous
The log appears. Press q at anytime to exit from the log.

To view a historic log:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the historic log you want to view:
npadmin@ia(config) # show log history
For example:
npadmin@ia(config) # show log elasticsearch history
The historic log appears. Press q at anytime to exit from the log.