> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/administration/logging.md).

# Logging

ExaVault maintains two different kinds of logs. Activity records answer who performed an action and whether it succeeded. Appliance service logs contain diagnostic output from the services that run ExaVault. Start with Activity when investigating user or file activity, and use service logs when troubleshooting a protocol or appliance component.

Premium customers can also [export Activity records through Syslog](/administration/logging/syslog-export.md). Syslog does not forward the appliance service logs stored on the server.

| Log Type         | Use It For                                                      | Storage and Retention                                                                                                      |
| ---------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Activity records | Auditing user, administrator, authentication, and file activity | Stored in annual Elasticsearch indexes named `audit-YYYY`. Records remain until an administrator deletes the yearly index. |
| Service logs     | Diagnosing protocols, background work, and appliance services   | Stored under `/data/exavault/logs/`. Daily files continue to accumulate until an administrator removes them.               |
| Syslog stream    | Sending Activity records to an external collector               | Retention is controlled by the external collector.                                                                         |

## Finding Activity

Open *Logging* in the web interface and use *Activity Search*. You can filter by date range, action, user, connection type, and source IP address. *Filter Like This* starts a search from a selected record and can include its file or folder path.

Activity records include the timestamp, acting user, action, result, source IP address, connection type, and affected object. Authentication records include successful logins, failed logins for known users, and logouts. File records cover actions such as upload, download, create, move, copy, delete, restore, and move to trash.

Use the narrowest practical time range. Add the username or source IP address for a login investigation, and add the action and path for a file investigation. Moves and copies create separate source and destination records, shown as *Moved From* and *Moved To* or *Copied From* and *Copied To*.

Activity records do not expire automatically. If old records consume too much storage or affect search performance, follow [Deleting Old Activity](/administration/logging/deleting-old-activity.md). Deleting an annual index permanently removes every Activity record for that year.

## Finding Appliance Service Logs

Service logs are written under `/data/exavault/logs/`. Completed daily files are compressed with gzip and use UTC dates in names such as `fileserver-sftp.20260915.log.gz`. Each record identifies the container, whether the message came from standard output or standard error, and the service's log message.

Choose the filename prefix for the affected service or workflow:

| Filename Prefix     | Service or Workflow                                                                        |
| ------------------- | ------------------------------------------------------------------------------------------ |
| `admin-dashboard`   | Appliance Manager, licensing, certificates, and appliance configuration                    |
| `mariadb`           | Relational database                                                                        |
| `elasticsearch`     | Activity search storage and indexing                                                       |
| `rabbitmq`          | Background-job messaging                                                                   |
| `haproxy`           | Incoming connection routing                                                                |
| `api`               | API application                                                                            |
| `web`               | Main web application                                                                       |
| `link`              | Public Link application                                                                    |
| `openresty`         | Web proxy and request handling                                                             |
| `preview`           | File preview service                                                                       |
| `fileserver-sftp`   | SFTP service                                                                               |
| `fileserver-webdav` | WebDAV service                                                                             |
| `celery`            | Background jobs, notifications, email, automation, retention, quota, and move or copy work |
| `data`              | FTP and services without a dedicated filename prefix                                       |

Select the UTC-dated file that covers the event, then search for the timestamp, username, path, remote address, request identifier, or error text. The `celery` and `data` files combine output from multiple workers or services; use the record's container name to identify the exact producer.

A single operation can cross several services. For example, an upload can involve `haproxy`, a protocol service, the main application, and a background worker. Compare entries using the same timestamp and request details rather than assuming one file contains the entire operation.

Service log files are not removed automatically. Monitor the space they consume and retain or remove old files according to your organization's operational and audit requirements.