--- title: "Audit Logs" slug: "usage-audit-logs-v6-5" description: "Configure Audit Logs in AppGate to analyze logs with OpenSearch, create custom reports, and visualize performance metrics effectively." updated: 2025-12-04T17:00:51Z published: 2025-12-04T17:00:51Z canonical: "support.appgate.com/usage-audit-logs-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit Logs Only when the [LogServer function](/v1/docs/functions-1#logserver) has been configured on an Appliance within the Collective will there will be an Audit Logs menu item shown. If it is not showing yet, sign-out of the admin UI and then sign-in again. The Audit Logs menu item will redirect you to the LogServer which uses OpenSearch as the UI engine for searching / displaying logs. Appgate SDP provides a number of pre-configured report scripts. The UI also provides a number of tools to create your own data reports and 'visualizations' to illustrate Appgate SDP performance. Details of all the different types of Audit Logs generated by the Appgate SDP Collective are provided in the [System monitoring and logs](/v1/docs/audit-log-detail-1) section. ## Background information For information about the handling of audit logs within the Appgate SDP system refer to the [System monitoring and logs](/v1/docs/audit-logs) section. ## Using The LogServer This page provides details about how to use OpenSearch and perform some basic searches. For more information you can also try the OpenSearch User Guide: [https://docs.aws.amazon.com/opensearch-service/?id=docs_gateway](https://docs.aws.amazon.com/opensearch-service/?id=docs_gateway) ### Pre-configured tools The menu (top left) includes OpenSearch Dashboards. the following three are likely to be of most use: ***Dashboard*** There are two prepared dashboards: *Appgate Appliances* and *Appgate* *User Activity*. ***Visualize*** There is a list of prepared visualizations such as *Client version used by OS* and *Configuration changes*. ***Discover*** This is the main tool for performing log analysis. There are also some pre-prepared search scripts which can be accessed by clicking **Open** at the top right hand side of the screen: *Pre-configured logserver scripts:* ![Pre-prepared search scripts including authentication and device claims.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61_os_scripts.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) *Changing time-frame* To change the time-frame for the audit log report, click on the calendar button next to the displayed time window: ![Time selection options for changing the time frame of an audit report.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61-ls_time.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) *Filtering the data* *Changing parameters* You can add or delete the parameters that are included in the search report. For example the "Controller Audit logs" script displays the Time, DN, daemon and event-type parameters: ![Gateway audit logs displaying session events and timestamps for monitoring activity.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61-ls1.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) To add a parameter to the report, use the Available Fields list on the left hand side of the UI and click <+> next to the parameter you wish to add to the report. To remove a parameter from the report, use the Selected Fields list on the left hand side and click next to the appropriate parameter: ![Log analysis interface displaying event types and distinguished names with a bar chart.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61-ls2.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) *Filtering searches* It is also easy to filter searches. Just expand any field and it shows the most common values in that field. The <+> & <-> can be used to filter the search to include or exclude that type. ![Logstash audit logs displaying event types and their corresponding counts over time.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61-ls4.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) In this case only cz-vpnd logs are displayed *Using the search bar* You can enter your own search terms in the search bar to customize searches such as: `event_type: ip_access && distinguished_name_user: testuser` However it might be easier to just filter by value. The <+> & <-> can be used to filter the search to include or exclude that value. ![Audit logs displaying event types and timestamps for various daemons and distinguished names.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag61-ls3.png?sv=2026-02-06&spr=https&st=2026-10-28T20%3A59%3A40Z&se=2026-10-28T21%3A59%3A40Z&sr=c&sp=r&sig=XSM8W9p1xR69YgpKx1Pi3EADd%2Bp8updD%2FQEuhul6dX4%3D) In this case the type filter is 'authentication_succeeded' and the value filter is for 'Annie'. The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions. The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.