Viewing events
July 25, 2024
ID 201952
You can view events in the following ways:
- In the application event log. The event log is located in the directory specified by the
EventsStoragePath
general application setting. By default, the application saves information about events to the /var/opt/kaspersky/kics/private/storage/events.db database. Root privileges are required to access the database of events. - In the general application settings, if the
UseSysLog
setting has the valueYes
, then event data is also written to syslog. Root privileges are required to access syslog. - Enable output of current application events using the
kics-control -W
command. - If Kaspersky Industrial CyberSecurity for Linux Nodes is managed using Kaspersky Security Center, information about events may be transmitted to the Kaspersky Security Center Administration Server. Aggregation rules apply to certain events. If a large number of same-type events are created within a short period of time while the application is running, the application will switch to event aggregation mode and send to Kaspersky Security Center one aggregated event with a description of the events settings. Different aggregation rules may be used for different events. The administrator can configure the execution of a script upon receiving events from the application or upon receiving notifications about events by e-mail. For more information about events, refer to Kaspersky Security Center documentation.
- If the graphical user interface (GUI) is enabled, information about events can be viewed in reports and in application pop-up windows.
To get information about all events in the event log, run the following command:
kics-control -E --query|less
By default, the application stores up to 500,000 events. You can use the less
command to navigate through the list of displayed events.
You can view specific events using the application's event store query system.
When creating a query, indicate the required field, select a comparison operator, and specify the desired value. The value must be specified in single quotation marks ('), and the whole query must be specified in double quotation marks ("):
--query "<
field
> <
comparison operator
> '<
value
>' [and <
field
> <
comparison operator
> '<
value
>' *]"
You can specify a date value in UNIX time (the number of seconds that have elapsed since 00:00:00 (UTC), January 1, 1970) or in YYYY-MM-DD hh:mm:ss
format. The user specifies the date and time in the user's local time zone, and the application displays them in the same time zone.
ThreatDetected example:
|
Query examples: Get all events by the EventType field:
Display all events with the specified values of the EventType and FileName fields:
Get events generated by File_Threat_Protection task after the date specified in UNIX time (the number of seconds that have elapsed since 00:00:00 (UTC), January 1, 1970):
Get all events generated by the File_Threat_Protection task after the date specified in YYYY-MM-DD hh:mm:ss format:
|