Kaspersky Unified Monitoring and Analysis Platform

KUMA logs

Some KUMA services and resources can log information related to their functioning. This feature is enabled by using the Debug drop-down list or check box in the settings of the service or the resource.

The logs are stored on the machine where the required service or the service using the required resource is installed:

• Logs residing on Linux machines can be viewed using the journalctl command in the Linux console.

  Examples:

  • journalctl -u kuma-collector * kuma-correlator * -f will return the latest logs from the collectors and the correlators installed on the server where the command was executed.
  • journalctl -u kuma-collector-<service ID> will return the latest logs of the specific collector installed on the server where the command was executed.
• Logs on Windows machines can be viewed in the file located at the path %PROGRAMDATA%\Kaspersky Lab\KUMA\<Agent ID>\agent.log. The activity of Agents on Windows machines is always logged if they are assigned the logon as a service permission. Data is specified in more detail when the Debug check box is selected.

Services where logging is available:

• Correlators
• Collectors
• Agents

Resources where logging is available:

• Connectors
• Enrichment rules
• Destinations

The logs on Windows machines are updated within a month. After a month expires, the log is archived, and events begin to be recorded in a new log. A maximum of three archived logs are stored on the server at a time. When a new log archive appears, if there are more than three archives, the oldest one is deleted.