System Log

Scenarios

After an operator logs in to a bastion host and performs operations such as permission configuration and audit management, the bastion host system generates corresponding system logs. Auditors can check system logs online to view detailed system login and operation records. They can also export system logs for offline audit.

Log Types

Prerequisites

The role you belong to has the management permission for the System Logon and System Operation log modules. For details about how to view the permissions of each role, see Role.

Searching for and Viewing System Logs

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Audit > System Log to go to the system log page.
3. Search for and view system login logs.
   1. On the System Logon tab, view system login logs.
      Figure 1 System login log information
      

      Table 1 Parameters of system login logs

      Parameter	Description
      Time	Time when a user logs in to or out of the system.
      User	User login name.
      Source IP	IP address of the login user.
      Content	Login status, which can be Logged out or Logged in.
      Logon Type	Method for logging in to the system.
      Result	Result of logging in to or logging out of the system.
      Remarks	Failure cause or other remarks.

   2. Configure search criteria to filter system login logs.
      Figure 2 Configuring search criteria
      
      • Basic search

        Select a search attribute from the drop-down list on the left, such as user, source IP address, or log content. Enter a keyword in the search box and click or press Enter.

      • Advanced search

        Click Advanced to expand all advanced search attributes. Enter keywords in the search boxes of the corresponding attributes and click Search.

4. Search for and view system operation logs.
   1. On the System Operation tab, view system operation logs.
      Figure 3 System operation log
      

      Table 2 Parameters of system operation logs

      Parameter	Description
      Time	Time when the user performs the operation.
      User	User login name.
      Source IP	IP address of the operator.
      Module	Module where the user performs the operation.
      Content	Description of the user operation.
      Result	Operation result.
      Remarks	Failure cause or other remarks.

   2. Configure search criteria to filter system operation logs.
      Figure 4 Configuring search criteria
      
      • Basic search

        Select a search attribute from the drop-down list on the left, such as user, source IP address, or log content. Enter a keyword in the search box and click or press Enter.

      • Advanced search

        Click Advanced to expand all advanced search attributes. Enter keywords in the search boxes of the corresponding attributes and click Search.

Exporting System Logs

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Audit > System Log to go to the system log page.
3. Click the System Logon or System Operation tab.
4. (Optional) Select one or more logs. If no log is selected, all logs in the current log list are exported by default.
5. Click in the upper right corner and create an export task.

   After you click , the system generates two system operation log records. One is for the task creation log triggered when you click the export button, and the other is for the packing task log, which records the packing result.

6. Click Go to Download Center to go to the download task list.
7. When the packing progress of the download task reaches 100%, click Download in the Operation column to download the file to a local PC. Open the local file and view the exported system logs.
   Figure 5 Download