Skip to main content
McAfee Enterprise MVISION Cloud

Use Syslog with the Logging Client

Using syslog with the Logging Client allows you to pull data in a .csv (by default) or in .json format.

Log pulling with syslog

During syslog logging, a temporary file storage called pending-events, is created under ..\Users\pb\AppData\Roaming\logging-client and the files are temporarily pushed there. Once all the file contents are logged, the file is purged from the pending-events folder. The service assures that all data is pulled successfully on each scheduled interval or pull. If a pull fails, the Logging Client captures the error in the error log located at C:\Users\<username>\ AppData\Local\logging_client\app-1.0.6\logs.

Logging is carried out in a queued approach, where files are taken in a first-come, first-served basis. After logging the data completely from the file, the file is removed from the temporary folder (C:\Users\<username>\AppData\Roaming\logging-client \pending-events). There is an expected lag between pulling data from the server and logging, especially if it happens via TCP.

Configuration files that store the timestamp and queing information have been moved to SQLite. The database file is configuration.db, which is available under ..\Users\pb\AppData\Local\logging_client\app-1.0.6.

IMPORTANT: Do not use the db file while logging is in process.

Changing syslog events to JSON 

Syslog events are supported in both CSV and JSON formats. CSV is the default format.

To change the file format to JSON:

  1. Uninstall the Logging Client.
  2. Reinstall the latest version of the Logging Client.
  3. Before starting the service, go to C:\Users\<username>\AppData\Local\logging_client\app-1.0.6\resources\app\lib\assets\config\settings.json
  4. Change the output from csv to json.
  • Was this article helpful?