Viewing local log files

You can view local log files from the managing Central Management appliance or from individual sensors or hybrid appliances and nodes. The log files contain information about all system activity. IVX cluster-specific log messages are only a part of the log file. You can filter the log files for only these messages.

When you filter log files, the entries that match or do not match a specified regular expression are displayed. You can filter the output from the current log file, an archived log file, or all log files. You can also specify which new entries from a continuous log should be displayed. When you filter all log files, the output is presented in a single view. The entries are displayed in forward chronological order, based on the last modification date.

Caution
When you filter all log files, the results are not displayed until all entries in all log files are processed. A progress bar indicates the status of the processing. Because the volume can be high with this option, be careful with your choice of regular expression.

For information about managing local logs, see the log management sections in the System Administration Guide or Administration Guide for the appliance and the CLI Command Reference.

Prerequisites

Auditor, Operator, or Admin access

Filtering log output using the Web UI

Use the Log Management page of the sensor, hybrid appliance, or Central Management appliance to generate log files and download them. You can then search the log files for

IVX cluster-specific messages, as described in this section.

Generate a log file:

Log in to the appliance Web UI.
Click the About tab.
Click Log Manager.
Click Selected logs. All categories are selected by default.
Select or clear checkboxes to specify the categories you want to include in the logs.
If a drop-down list is present, select the time period the log should cover. The default is Today. The other options are Past week, Past 2 weeks, and Past month.
Clear the Password-protect generated log archive checkbox.
Important
If this checkbox is selected, you will be unable to open the files.
Click Create. A status message is displayed while the log is being created.

Download a log file to your local file system:

Locate the log file archive in the Log Archives section.
Click the icon in the Action column, and then select Download.
The log archive is downloaded to your local file system. The archive name begins with the hostname of the appliance.

Filter the log output:

Locate the file and open it in a text editor or program of your choice.
Search for the keywords of interest (for example, enrollment or token).

Filtering log output using the CLI

Use the commands in this section to use regular expressions to filter the log display to include only IVX cluster-specific information.

To filter the active log:

Enable the CLI enable mode:
```
hostname > enable
```
To display only the lines that match a regular expression:
```
hostname # show log matching <regular expression>
```
To display only the lines that do not match a regular expression:
```
hostname # show log not matching <regular expression>
```

To filter an archived log:

Enable the CLI enable mode:
```
hostname > enable
```
List the logs:
```
hostname # show log files
```
To display only the lines in an archived log that match a regular expression:
```
hostname # show log files <number> matching <regular expression>
```
where <number> is the number of the file in the list of log files.
To display only the lines in an archived log that do not match a regular expression:
```
hostname # show log files <number> not matching <regular expression>
```

To filter the new lines as they are added in real time:

Enable the CLI enable mode:
```
hostname > enable
```
To start printing only the new lines in the active log that match a regular expression:
```
hostname # show log continuous matching <regular expression>
```
To start printing only the new lines in the active log that do not match a regular expression:
```
hostname # show log continuous not matching <regular expression>
```

To filter all logs:

Enable the CLI enable mode:
```
hostname > enable
```
To view only the lines in all logs that match a regular expression:
```
hostname # show log files all matching <regular expression>
```
To view only the lines in all logs that do not match a regular expression:
```
hostname # show log files all not matching <regular expression>
```