Logs Configuration

TheHive uses logback to log information about the running process. The loggers are configured in the file /etc/thehive/logback.xml. Edit this file and reload the service to apply your changes.

By default, logs are stored in /var/log/thehive/. The last log file is called application.log and older filed are stored in a compressed format in application.%i.log.zip.

How to increase/decrease the log level

Logback supports several log levels.

To log more things you can update the root level to DEBUG (or TRACE):

logback.xml

    <!-- ... -->
    <root level="DEBUG">
        <!-- ... -->
    </root>

To log less things you can use WARN, ERROR or OFF levels.

The log level can also be updated individually by changing the level of a specific logger:

logback.xml

    <logger name="org.thp" level="DEBUG"/>

Logs in docker

In the docker container the logger is configured with the file /etc/thehive/logback.xml and the application by default will log to stdout and to /var/log/thehive/application.log.

If you want to change the default configuration, you can mount your own logback file to /etc/thehive/logback.xml.

Debug your logback configuration

If you have issues with it set the debug flag to true in logback.xml:

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="true">

This will log your logback configuration in the console when the app starts

How to create an access log

By changing the logback configuration, you can redirect certain logs from the application. Below is an example where access logs are redirected to the file access.log and uses a rolling file strategy.

To apply this in your configuration, copy the appenders and loggers definitions.

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">

    <!-- ... other appenders and settings -->

    <appender name="ACCESSFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>/var/log/thehive/access.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
            <fileNamePattern>/var/log/thehive/access.%i.log.zip</fileNamePattern>
            <minIndex>1</minIndex>
            <maxIndex>10</maxIndex>
        </rollingPolicy>
        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
            <maxFileSize>10MB</maxFileSize>
        </triggeringPolicy>

        <encoder>
            <pattern>%date [%level] from %logger [%traceID] %message%n%xException</pattern>
        </encoder>
    </appender>

    <appender name="ASYNCACCESSFILE" class="ch.qos.logback.classic.AsyncAppender">
        <appender-ref ref="ACCESSFILE"/>
    </appender>

    <logger name="org.thp.scalligraph.AccessLogFilter">
        <appender-ref ref="ASYNCACCESSFILE" />
    </logger>
    <logger name="org.thp.scalligraph.controllers.Entrypoint">
        <appender-ref ref="ASYNCACCESSFILE" />
    </logger>

    <root level="INFO">
        <!-- other appender-refs ... -->
    </root>

</configuration>

How to send logs to syslog

You will need to add a SyslogAppender.

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">

    <!-- ... other appenders and settings -->

    <appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
        <syslogHost>remote_host</syslogHost>
        <facility>AUTH</facility>
        <suffixPattern>[%thread] %logger %msg</suffixPattern>
    </appender>

    <root level="INFO">
        <appender-ref ref="SYSLOG" />
        <!-- other appender-refs ... -->
    </root>

See the official docs for more information.

Limitations: The official syslog appender can only send logs via UDP to a server. It cannot use TCP and TLS