Logs & Diagnostics

Logging and diagnostics in Haltdos platform

Overview

Haltdos Platform also provides rich logs for various apps. The logs are available for downloading from the GUI, CLI or can be queried through APIs. Depending upon the provided appliance, local logs storage can be retained for up to 6 months for compliance. Users can make use of Backup and Syslog integrations to increase rentention of logs as per organization policy.

NOTE:

Haltdos solutions are designed to respect GDPR and Privacy Policy and do not contain any PII information. However, the responsibility lies with the customer to ensure that the information logged by various solution are meeting their respective compliance.

All logs are written in JSON format. Logs written to Syslog are in CEF format for simple integration

Logging

Haltdos platform generates extensive logging for diagnostics, compliance and audit purposes.

Platform Logs

Haltdos platform comprise of various services (GUI, CLI, API, etc.) and supports RBAC based user access and management with further support for multi-tenancy. Each service generates the following logs:

• Diagnostic Logs: These logs record details of internal working of the service for issue diagnosis (if any)

• Audit Logs: These logs record details of user activity through GUI or CLI

App Logs

Each app (WAF, DDoS, LLB, etc.) generates four categories of logs:

• Event Logs: These logs record details of incidents discovered by the solution such as attack, system failure, network failure, server down, link down, etc.

• Access Logs: These logs record details of ongoing activity on the protected assets. For example, WAF will record access log request to configured website / web services.

• Metric Logs: These are periodic logs that are used in generation of reports and show real-time dashboards regarding usage, attack summary, etc.

• Diagnostic Logs: These logs records the details internal working of the app to carry out issue diagnosis.

Packet Capture

Haltdos platform provides functionality of packet capture through GUI and CLI. Once packet capture is complete, the captured packets are available for download in pcap format from GUI through Events page.

Packet Capture

How to Use:

1. Go to Stack > Instance > (Select Instance) > Network > Ethernet > (Select NIC Interface)

2. Click Packet Capture button

3. Click Run Capture.

Settings

PARAMETER	DESCRIPTION	ACCEPTED VALUES	DEFAULT
Network Interface	Specify the network interface name	Drop-Down	0
Packet Count	Number of packets to be captured	Integer	10
Filter Type	Specify filter during packet capture	Drop-down	Source IP
Filter Value	Specify filter value	String	Empty