> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/logs-server-configurations.md). # Logs Server Configurations | Key | Description | Default | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | **`http.access.log.enabled`** | Whether to enable or disable the log. For more information, see [Configure the Access Log for HTTPS Requests](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md). | **`false`** | | **`log.accesslog.filename`** | The filename of the log. For more information, see [Configure the Access Log for HTTPS Requests](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md). | **`access_log`** | | **`log.accesslog.rolling.backups`** | The number of backups. For more information, see [Configure the Access Log for HTTPS Requests](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md). | **`3`** | | **`log.accesslog.rolling.maxage`** | The number of days to preserve the log file. For more information, see [Configure the Access Log for HTTPS Requests](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md). | **`0`** | | **`log.accesslog.rolling.maxfilesize`** | The maximum number of megabytes when a new file is created. For more information, see [Configure the Access Log for HTTPS Requests](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md). | **`10`** | | **`log.http.traffic`** | Whether to write to logs the http requests and responses to/from integrations (only in debug). Relevant for integrations in JavaScript. Set to true. | **`false`** | | **`log.rolling.backups`** | Number of backup files. Change if you want to store a different number of backup files. For more information, see [Configure the Server Log](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md). | **`3`** | | **`log.rolling.maxage`** |

The maximum number of days to retain old log files based on the timestamp encoded in their filename.

Note

A day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc. For more information, see Configure the Server Log.

| **`0`**: Not to remove old log files based on age. | | **`log.rolling.maxfilesize`** | The maximum log file size. Large files may affect performance, like 1GB. For more information, see [Configure the Server Log](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md). | Log rotation at **`10`** MB | | **`LogFile`** |

Changes the default engine log file: /var/log/demisto/d1.log

Needs to be in the same directory as the Engine configuration file. If you change it, it might not be found easily when debugging.

| N/a | | **`preprocesslogs.file`** | For troubleshooting, you might need to identify which pre-process rule was triggered. This configuration stores pre-process logs in a separate file. Relevant for v6.5 and above. For more information, see [Create Pre-Process Rules for Incidents](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md#UUID-e49e2cac-8f6f-17d7-51fc-b69b438ccd7c). | **`false`** | | **`syslog.enabled`** | Enables syslog. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | **`false`** | | **`syslog.filter`** | Adds filter. Values: **`object or action`**. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | N/a | | **`syslog.format`** | For example, RFC3164, RFC5424. Default is empty, which uses a custom format that is a combination of both formats. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | Empty | | **`syslog.host`** | Name of the syslog server. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | N/a | | **`syslog.port`** | The destination port. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | Default is a number for LOG\_INFO with LOG\_DAEMON. | | **`syslog.priority`** | Default is a number for LOG\_INFO with LOG\_DAEMON. If you want to change the default, contact Cortex XSOAR Customer Support. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | N/a | | **`syslog.protocol`** |

The syslog protocol.

Values:

For more information, see Send the Audit Trail to an External Log Service.

| **`unix`** (for localhost syslogging) | | **`syslog.tag`** | The syslog tag. For more information, see [Send the Audit Trail to an External Log Service](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md). | **`Demisto`** | | **`demisto.audits.purge.delay`** | How often to check the audit log. Default is every 24 hours. | **`24`** | | **`demisto.audits.purge.retention`** | Number of days to save the audit log. | **`365`** | | **`demisto.audits.purge`** | Whether to purge audit logs | **`False`** | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/logs-server-configurations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.