Logs Configuration

TheHive utilizes logback for logging purposes, allowing users to monitor the running process effectively. The logging settings are managed through the configuration file located at /etc/thehive/logback.xml. Changes made to this file require a service reload to take effect.

By default, logs are stored in /var/log/thehive/, with the most recent log file named application.log, while older files are compressed and stored as application.%i.log.zip.

Adjusting Log Levels

Logback offers various log levels to control the amount of information logged. To increase or decrease the log level:

Update the root level to DEBUG or TRACE to log more information:

logback.xml

    <!-- ... -->
    <root level="DEBUG">
        <!-- ... -->
    </root>

Alternatively, adjust the log level for specific loggers:

logback.xml

    <logger name="org.thp" level="DEBUG"/>

You have the option to select from the following additional log levels: WARN, ERROR, or OFF.

Docker Logs Configuration

In a Docker container, TheHive logs to stdout and /var/log/thehive/application.log by default. To customize this behavior, mount your own logback file to /etc/thehive/logback.xml.

Debugging Logback Configuration

To troubleshoot logback configuration issues, set the debug flag to true in logback.xml:

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="true">

This will log the logback configuration in the console during application startup.

Creating an Access Log

To redirect certain logs from the application, such as access logs, modify the logback configuration. Here's an example configuration for redirecting access logs to a file named access.log using a rolling file strategy:

To add this into your configuration, duplicate the definitions of appender and logger as demonstrated below.

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">

    <!-- ... other appenders and settings -->

    <appender name="ACCESSFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>/var/log/thehive/access.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
            <fileNamePattern>/var/log/thehive/access.%i.log.zip</fileNamePattern>
            <minIndex>1</minIndex>
            <maxIndex>10</maxIndex>
        </rollingPolicy>
        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
            <maxFileSize>10MB</maxFileSize>
        </triggeringPolicy>

        <encoder>
            <pattern>%date [%level] from %logger [%traceID] %message%n%xException</pattern>
        </encoder>
    </appender>

    <appender name="ASYNCACCESSFILE" class="ch.qos.logback.classic.AsyncAppender">
        <appender-ref ref="ACCESSFILE"/>
    </appender>

    <logger name="org.thp.scalligraph.AccessLogFilter">
        <appender-ref ref="ASYNCACCESSFILE" />
    </logger>
    <logger name="org.thp.scalligraph.controllers.Entrypoint">
        <appender-ref ref="ASYNCACCESSFILE" />
    </logger>

    <root level="INFO">
        <!-- other appender-refs ... -->
    </root>

</configuration>

Sending Logs to Syslog

To send logs to syslog, add a SyslogAppender to the logback configuration:

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">

    <!-- ... other appenders and settings -->

    <appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
        <syslogHost>remote_host</syslogHost>
        <facility>AUTH</facility>
        <suffixPattern>[%thread] %logger %msg</suffixPattern>
    </appender>

    <root level="INFO">
        <appender-ref ref="SYSLOG" />
        <!-- other appender-refs ... -->
    </root>

Refer to the official documentation for more details.

Limitations: The official syslog appender only supports sending logs via UDP to a server and does not support TCP and TLS.