In the application event log. The event log is located in the directory specified by the EventsStoragePathgeneral application setting. By default, the application saves information about events to the following database directory /var/opt/kaspersky/kics/private/storage/events.db. Root privileges are required to access the database of events.
If the UseSyslog=Yesgeneral application setting is used, information about events is also logged to syslog. Root privileges are required to access syslog.
If Kaspersky Industrial CyberSecurity for Linux Nodes is managed by Kaspersky Security Center, information about events may be transmitted to the Kaspersky Security Center Administration Server. If three events of the same type, from the same initiator, with the same name are created within one minute, then the application switches to event aggregation mode and sends one aggregated event that describes these recurring events to Kaspersky Security Center every 10 minutes. Kaspersky Industrial CyberSecurity for Linux Nodes administrator can configure the execution of a script upon receiving events from the application or upon receiving notifications about events by e-mail. For more information about events, refer to Kaspersky Security Center documentation.
If the graphical user interface (GUI) is enabled, information about events can be viewed in reports and in application pop-up windows.
To get information about all events in the event log, run the following command:
kics-control -E --query|less
By default, the application stores up to 500,000 events. You can use the less command to navigate through the list of displayed events.
You can view specific events using the application's event store query system.
When creating a query, specify the required field, select a logical expression, and specify the required value for it. The value must be specified in single quotation marks ('), and the whole query must be specified in double quotation marks ("):