Download

Navigation: Diagnostics > Audit > Download

The Download tab allows you to download the complete audit log as a tar archive for external archiving, forensic analysis, or integration with a SIEM system. The downloaded file contains the original output of the Linux auditd service, which preserves more detailed information than what is displayed in the web interface. While the other Audit tabs show only selected important entries, the raw files in this archive contain the full audit trail.

Downloading the audit log

Click the Download audits button to generate and download the audit log archive. The device packages the raw auditd log files into a tar archive and initiates a file download in your browser.

The downloaded archive is intended for:

• IT forensic analysis — Security specialists can examine the raw audit records for detailed investigation of security incidents, including low-level events not shown in the web interface.
• SIEM integration — The files use the standard Linux auditd log format, which is supported by common Security Information and Event Management (SIEM) systems for automated ingestion and correlation.

Note

The audit log is a shared 40 MB ring buffer. When the buffer is full, the oldest entries across all tabs are overwritten. Download the audit log regularly and archive it on an external system to ensure long-term retention of security-relevant records.

ATTENTION

The audit log archive may contain security-sensitive information such as usernames, IP addresses, and detailed records of configuration changes. Handle the downloaded file in accordance with your organization's information security policies.