> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/logging/where-do-i-find-which-enginsight-logs.md).

# Where do I find which Enginsight logs?

The Enginsight platform consists of many components whose logs can be found in different locations and, depending on the operating system, can be retrieved and saved in different ways. 

In the following, we will show you where to find which Enginsight logs.

***

## Pulsar

The log for the Enginsight agent Pulsar is called **ngs-pulsar.log**. Depending on the host operating system, you can find the Pulsar log under the following directory paths:

<table><thead><tr><th width="224.66796875">Operating system</th><th>Storage location</th></tr></thead><tbody><tr><td>Windows</td><td>C:\Program Files\Enginsight\Pulsar\ngs-pulsar.log</td></tr><tr><td>Linux</td><td>/opt/enginsight/pulsar/ngs-pulsar.log</td></tr><tr><td>macOS</td><td>/opt/enginsight/pulsar/ngs-pulsar.log</td></tr></tbody></table>

{% hint style="warning" %}
**Please note**: The Pulsar log is automatically clipped to **2 MB** (most recent entries) at each start of the Pulsar.
{% endhint %}

***

## Hacktor, Observer, and Watchdog

For the Enginsight components Hacktor, Observer, and Watchdog, the log directories differ depending on the Linux operating system used.

### Debian 12 and Later Versions

Starting with Debian 12, system logs are managed via `journalctl` by default. The logs of the Enginsight components are therefore no longer written to the classic syslog.

The logs for the Enginsight components Hacktor, Observer, and Watchdog are called **ngs-hacktor.log**, **ngs-observer.log**, and **ngs-watchdog.log**.

You can show or save the log of a component using one of the following commands:

**Displaying logs**:

```
sudo journalctl -u ngs-<ComponentName> -n 50
```

**Saving logs**:

```
sudo journalctl -u ngs-<ComponentName> -n 50 > /tmp/ngs-<ComponentName>.log
```

{% hint style="info" %}
Remember to replace `<ComponentName>` with the name of the component whose logs you want to view. These commands show or save **the last 50 log entries**. Adjust the number `50` if you want to view more log entries.
{% endhint %}

### Older Debian Versions and CentOS

On older systems, component logs are still written to the classic syslog.

You can save the logs of the corresponding component as a **.txt** file using the following commands:

#### Debian

```
cat /var/log/syslog | grep -a hacktor-m24 > /tmp/<CustomFileName>.txt
cat /var/log/syslog | grep -a observer-m9 > /tmp/<CustomFileName>.txt
cat /var/log/syslog | grep -a watchdog-m23 > /tmp/<CustomFileName>.txt
```

#### CentOS

```
cat /var/log/messages | grep -a hacktor-m24 > /tmp/<CustomFileName>.txt
cat /var/log/messages | grep -a observer-m9 > /tmp/<CustomFileName>.txt
cat /var/log/messages | grep -a watchdog-m23 > /tmp/<CustomFileName>.txt
```

{% hint style="info" %}
Remember to replace `<CustomFileName>` with a file name of your choice.
{% endhint %}

***

## Audits (Penetration Tests)

You can find the logs of penetration test audits under the following directory path:

```
/opt/enginsight/hacktor/logs/audit-<ID>.txt
```

{% hint style="info" %}
The `<ID>` corresponds to the audit ID as displayed in the Enginsight platform.
{% endhint %}

***

## Loggernaut (SIEM)

The Loggernaut is a component of the Enginsight SIEM that receives and processes logs that are to be forwarded to the Data Lake.

### Loggernaut Log

The log for the Loggernaut component itself is called **ngs-loggernaut.log**. You can save the log using the following command:

```
sudo journalctl -u ngs-loggernaut.service -n 50000 > ngs-loggernaut.log
```

### Backup Logs

You can also create and save backups for individual organizations. You can find these logs under the following directory path:

```
/opt/enginsight/loggernaut/backup/<OrganizationID>/
```

{% hint style="info" %}
The `<OrganizationID>` corresponds to the organization ID as displayed in the Enginsight platform.
{% endhint %}

***

## Docker Containers (e.g. for Enginsight Services)

To retrieve the logs of individual Enginsight Docker containers, follow these steps:

{% stepper %}
{% step %}
Log in to the **Enginsight Application Server** and navigate to the directory where Enginsight is installed using the following command:

```
cd /opt/enginsight/enterprise
```

{% endstep %}

{% step %}
Show all running Docker containers using the following command to retrieve the respective container IDs:

```
sudo docker ps
```

{% endstep %}

{% step %}
Show the required log using the following command:

```
sudo docker logs <ContainerID> 
```

{% hint style="info" %}
Remember to replace `<ContainerID>` with the correct ID of the container in which the service whose log you want to display is running.
{% endhint %}
{% endstep %}

{% step %}
Save the required log using the following command:

```
sudo docker logs <ContainerID> -t >& <CustomFileName>.txt
```

{% hint style="info" %}
Remember to replace `<ContainerID>` with the correct ID of the container in which the respective service is running, and `<CustomFileName>` with a file name of your choice.
{% endhint %}
{% endstep %}
{% endstepper %}

***