Log analysis

Enable log collection and storage

1. Log on to the SASE console.

2. In the left-side navigation pane, choose Log Analysis > Log Analysis.

3. In the upper-right corner of the Log Analysis page, click Log Status to enable log collection and storage.

   SASE log types

   • Private access log

   • PA sensitive file download detection log

   • Enterprise acceleration log

   • Client logon log

   • Client status log

   • DLP log

   • OneData log

   • Internet access log

   • Dynamic decision log

   • Endpoint reinforcement log

   • Proactive defense log

   • Virus scanning log

   • Vulnerability patching log

View logs and enable log delivery

1. Click the drop-down list in the upper-left corner of the page.

2. Select the log type you want to view. You can filter the query results by specifying conditions.

3. Click the switch next to a log type to enable or disable log delivery for that log type.

   The supported log types include private access log, PA sensitive file download detection log, enterprise acceleration log, client logon log, client status log, DLP log, OneData log, and Internet access log.

4. In the search box at the top of the page, enter a search statement. In the time picker to the right of the search box, set a time range for your query.

   A query consists of a search statement and an optional analytic statement, separated by a vertical bar (|). The format is: Search statement|Analytic statement.

   Statement type	Optional	Description
   Search statement	Required	Specifies the search conditions. It can be a keyword, a fuzzy query, a numeric value, a numeric range, or a combination of conditions. If you leave this empty or enter an asterisk (*), all data within the specified time range is returned. For more information, see Query syntax and features.
   Analytic statement	Optional	Processes the data returned by the search statement for computation and aggregation. If you leave this empty, only the query results are returned and no statistical analysis is performed. For more information, see Query and analysis overview. Note In an analytic statement, you can omit the standard SQL clause from table_name, which is from log. By default, the first 100 log entries are returned. You can use the LIMIT clause to change the number of entries returned.

   Log analysis queries

   SASE client online status

   Before you use the following search statements, you must manually create an index for the app_status field. For more information, see Create an index.

   • Query the number of online terminal devices

     * AND log_type : client_status_log | select username,app_status,COUNT(*) AS cn GROUP BY username,app_status order by cn desc limit 10000

   • Query the number of offline terminal devices

     * AND log_type : client_status_log AND app_status:offline | select username,app_status,COUNT(*) AS cn GROUP BY username,app_status order by cn desc limit 10000

   SASE client logon

   Query terminal device logon actions

   * AND log_type : client_logon_log | select username,action,COUNT(*) AS cn GROUP BY username,action order by cn desc limit 10000

   Private access

   • Query for the devices and users that access the internal network

     * AND log_type : pa_access_log | select username,device_type,COUNT(*) AS cn GROUP BY username,device_type order by cn desc limit 10000

   • Query the reasons for blocked access

     * AND log_type : pa_access_log AND action:block | select username,block_info,COUNT(*) AS cn GROUP BY username,block_info order by cn desc limit 10000

   Sensitive file detection

   Query the number of times a sensitive file policy is matched

   * AND log_type : dlp_log | select username,matched_policy,COUNT(*) AS cn GROUP BY username,matched_policy order by cn desc limit 10000

5. Click Search & Analyze to view the analysis results.

   The SLS Logs feature provides query and analysis results in formats such as a log distribution histogram and Raw Logs. It also supports operations such as setting alerts, creating saved searches, refreshing, and sharing. For more information, see Description of the Search & Analyze page.

View data reports

You can view a Data Report for OneData log and Internet access log.

1. From the drop-down list, select OneData log or Internet access log, and then click the Data Report tab.

2. On the Data Report tab, view the log-related data.

   • Time Range: In the upper-right corner, click the time range to specify the period for the report.

   • Drill-Down Analysis: In the upper-right corner of the report, click the icon. In the Drill-Down Analysis dialog box, you can view data from different data sources.

     In the upper-left corner of the dialog box, select Prometheus from the Data Source Type drop-down list, set a time range, configure the metric query conditions (including Metrics Explorer, Region, and Instance), and then click Execute Query. On the right, you can switch between visualization types such as Table, Line, Bar, Stat, Pie, Gauge, and Meter.

Log fields