Logging

ExaVault maintains two different kinds of logs. Activity records answer who performed an action and whether it succeeded. Appliance service logs contain diagnostic output from the services that run ExaVault. Start with Activity when investigating user or file activity, and use service logs when troubleshooting a protocol or appliance component.

Premium customers can also export Activity records through Syslog. Syslog does not forward the appliance service logs stored on the server.

Log Type	Use It For	Storage and Retention
Activity records	Auditing user, administrator, authentication, and file activity	Stored in annual Elasticsearch indexes named audit-YYYY. Records remain until an administrator deletes the yearly index.
Service logs	Diagnosing protocols, background work, and appliance services	Stored under /data/exavault/logs/. Daily files continue to accumulate until an administrator removes them.
Syslog stream	Sending Activity records to an external collector	Retention is controlled by the external collector.

Finding Activity

Open Logging in the web interface and use Activity Search. You can filter by date range, action, user, connection type, and source IP address. Filter Like This starts a search from a selected record and can include its file or folder path.

Activity records include the timestamp, acting user, action, result, source IP address, connection type, and affected object. Authentication records include successful logins, failed logins for known users, and logouts. File records cover actions such as upload, download, create, move, copy, delete, restore, and move to trash.

Use the narrowest practical time range. Add the username or source IP address for a login investigation, and add the action and path for a file investigation. Moves and copies create separate source and destination records, shown as Moved From and Moved To or Copied From and Copied To.

Activity records do not expire automatically. If old records consume too much storage or affect search performance, follow Deleting Old Activity. Deleting an annual index permanently removes every Activity record for that year.

Finding Appliance Service Logs

Service logs are written under /data/exavault/logs/. Completed daily files are compressed with gzip and use UTC dates in names such as fileserver-sftp.20260915.log.gz. Each record identifies the container, whether the message came from standard output or standard error, and the service's log message.

Choose the filename prefix for the affected service or workflow:

Filename Prefix	Service or Workflow
admin-dashboard	Appliance Manager, licensing, certificates, and appliance configuration
mariadb	Relational database
elasticsearch	Activity search storage and indexing
rabbitmq	Background-job messaging
haproxy	Incoming connection routing
api	API application
web	Main web application
link	Public Link application
openresty	Web proxy and request handling
preview	File preview service
fileserver-sftp	SFTP service
fileserver-webdav	WebDAV service
celery	Background jobs, notifications, email, automation, retention, quota, and move or copy work
data	FTP and services without a dedicated filename prefix

Select the UTC-dated file that covers the event, then search for the timestamp, username, path, remote address, request identifier, or error text. The celery and data files combine output from multiple workers or services; use the record's container name to identify the exact producer.

A single operation can cross several services. For example, an upload can involve haproxy, a protocol service, the main application, and a background worker. Compare entries using the same timestamp and request details rather than assuming one file contains the entire operation.

Service log files are not removed automatically. Monitor the space they consume and retain or remove old files according to your organization's operational and audit requirements.