The Event and Audit Logs

The event log contains system and configuration messages, warnings, and errors from all Traffic Managers in your cluster. A truncated version of the event log can be found on the Home page of the Traffic Manager Admin UI. To view the full logs, click Examine Logs or Diagnose > Event Log.

The audit log monitors recent login attempts, configuration changes (by user and source IP address), and user logouts. It also records changes made using the Control API and REST API. To view the audit log, click Diagnose > Audit Log in the Traffic Manager Admin UI.

For virtual appliances and cloud instances, the Traffic Manager controls event log and audit log rotation automatically. Logs are rotated once the maximum file size of 50MB is reached for the current log. As the log is rotated, a new archive file is created for the log entries up to that point, and the current log cleared. Archive files are then compressed with "gzip" and given a filename in the format shown here:

•For audit logs: audit-<date>-<sequence>.gz

•For event logs: event-<date>-<sequence>.gz

where <sequence> is an incremental number provided for multiple same-day rotations.

For Traffic Manager software variants, you must enact your own rotation policy.

To access archived audit log files, click Manage archived audit logs on the Diagnose > Audit Log page. To access archived event log files, click Manage archived event logs on the Diagnose > Event Log page.

For each archived log, you can download or delete the file using the controls provided.

To override the default maximum file size used by the Traffic Manager for audit and event log file rotation, set the system level environment variables AUDITLOG_ROTATE_THRESHOLD or EVENTLOG_ROTATE_THRESHOLD correspondingly, although certain appliance and cloud variants might have an alternate automatic threshold that is implemented in place of this. For more details, see the Pulse Secure Virtual Traffic Manager: Installation and Getting Started Guide applicable to your product variant.