Web Isolation: Troubleshooting Management Audit Logs

Products

• Web Isolation

Issue/Introduction

Management GUI does not show logs in the Management Audit Logs

Resolution

1. Check if the management audit logs are the latest:

tail -f /var/log/fireglass_management_audit.log

 

2. Check if there are any issues with the management log on logstash:

curl http://x.x.x.x:9200/_cluster/health?pretty

curl http://x.x.x.x:9200/_cat/indices | sort | grep management-audit

curl http://x.x.x.x:9200/_cat/shards | grep management

 

Basically the status should be showing GREEN or STARTED

From the above we can delete the old log file and restart the logstash docker.

 

3. To delete a particular log, for example 'management-audit-2018.09'

curl -XDELETE http://x.x.x.x:9200/management-audit-2018.09

 

4. To Restart Docker

docker ps | grep logstash

docker restart [logstash container id]