Overview

This article provides information regarding the LanGuard logs location, their purpose, describes the LanGuard debug logs format, and helps with understanding the .csv logs format in particular.

Introduction

GFI LanGuard is using a GFI logger, which is writing text logs in the .csv files split by module, date, and size (rollover). 

There are operational logs that record the major events of the main modules (debug does not have to be enabled). They provide a good starting point for troubleshooting and are located in the %Data%\GFI\LanGuard 12\OperationalLogs\ folder. 

 

But much more information can be obtained by analyzing the debug logs. Debug logging in GFI LanGuard can be enabled from the registry on both the main application and the Agent machines. The logs are located in a subfolder of the data directory, %Data%\GFI\LanGuard 12\DebugLogs\.

 

Description

Operational Logs and Their Purpose

Below is a list of all GFI LanGuard operational logs created in %Data%\GFI\LanGuard 12\OperationalLogs\ folder and their purpose. Xxx in the file names (like lanss_vxxx_activitymonitor.csv) is the version number in real names (see screenshot above).

Name	Purpose
agenttransferdatasizelog.csv	Operational log file which records the amount of data transferred between the server and the agents
lanss_vxxx_op_agentmanager.csv	Operational log for the Agent Manager component
lanss_vxxx_op_dbprocessorop.csv	Operational log for the DB Processor component
lanss_vxxx_op_remediation.csv	Operational log for the Remediation component
lanss_vxxx_op_scheduledscans.csv	Operational log for the Scan Manager component
lanss_vxxx_op_securityscanner.csv	Operational log for the Scanner component
lanss_vxxx_op_update.csv	Operational log for the Update component
scheduledscanslog.txt	Operational log for the Scheduled Scans component

 

Debug Logs and Their Purpose

Below is a list of all GFI LanGuard debug logs created in %Data%\GFI\LanGuard 12\DebugLogs\ folder and their purpose. Xxx in the file names (like lanss_vxxx_activitymonitor.csv) is the version number in real names (see screenshot above).

Note: Highlighted items exist ONLY on machines where the main application is installed.

Name	Purpose
\Httpd\access.log.xxxxxx	Logfile from Apache Server that stores all the incoming requests
\Httpd\error	Apache debug log file. The logging level can be controlled by editing the file %Data%\GFI\LanGuard 12\HttpdConfig\product\loglevel.conf
lanss_vxxx_activitymonitor.csv	Debug log file for the activity monitor which displays active scans, etc.
lanss_vxxx_analyze.csv	Debug log for the Dashboard
lanss_vxxx_apistrings.csv	Debug log file for the module which loads branding and language strings in the UI
lanss_vxxx_appframework.csv	Debug log file for the .Net application framework
lanss_vxxx_attendantservice.csv	Debug log file of the Attendant service. Contains logging for all the modules loaded by the Attendant service
lanss_vxxx_centralmanagement.csv	Debug log file that logs for the operations towards Central Management Server, even if it isn't installed
lanss_vxxx_common.csv	Debug log file that logs domain-related tasks, database connection, and schedule computation
lanss_vxxx_computergrouppropeties.csv	Debug log for the computer properties GUI
lanss_vxxx_configtools.csv	Debug log file for various modules used in displaying information in the configuration
lanss_vxxx_crmimodule.csv	Debug log file for the CRMI module – the module which is used to access the configuration database
lanss_vxxx_dashboard.csv	Debug log file for the LanGuard Dashboard
lanss_vxxx_framework.csv	Main debug log file for the UI – this will take care of launching the different modules required in the UI
lanss_vxxx_httpserver.csv	Debug log file for Apache Server
lanss_vxxx_lnsscomm.csv	Debug log file of LNSSCOMM – the module used for inter-process communication between the UI and the LNSS scanning engine, and between the LNSS Scanning engine and the scheduled scans module; which is loaded by the attendant service
lanss_vxxx_patchdeployment.csv	Debug log file for the patch deployment and custom patch deployment UI modules
lanss_vxxx_remediation.csv	Debug log file for the Remediation Center activities
lanss_vxxx_reporting.csv	Debug log file for the Scan filters UI
lanss_vxxx_scriptingengine.csv	Debug log file for the Script Engine module
lanss_vxxx_securityscanner.csv	Debug log file for the modules which are loaded by the Service Provider module
lanss_vxxx_simpletools.csv	Debug log file for the Simple Tools UI and operational modules
lanss_vxxx_sshrunner.csv	Debug log file for the SSH module – the module used to run SSH scripts
lanss_vxxx_sqlquery.csv	Debug log for the SQL queries

Additionally, remediation job commands execution on the target machine is logged to the PatchAgent.log at %system%\Windows\Patches (unless otherwise changed in the settings).

 

Debug Logs Format

As seen in the screenshot in the Introduction section, the majority of LanGuard logs are stored in comma-delimited .csvformat, or as rollover .bak files. .csv is a popular file format and can be opened with lots of different tools. 

CSV stands for "comma-separated values". The first line of each line is a header stating the list of fields, and each line afterward is a log record produced by one of the LanGuard components or modules.

Working with .csv logs is pretty straightforward, let's take a look at the file in Notepad++. You can use any other text editor instead. Alternatively, opening the logs in Excel can be useful to follow the specific threads or sort by particular entry types.

Below is the screenshot of the lanss_v125_attendantservice.csv logfile in Notepad++:

The top line shows the list of fields:
Date,Time,Milliseconds,Log Level,Process ID,Thread ID,Event Type,Source,Description

All logs in LanGuard use the same set of fields:

• Date, Time, and Milliseconds = the time at which the event took place.

• Log Level indicates the log level for the given event.

• Process ID and Thread ID can be useful to follow a specific scan or a certain module.

• Event Type is one of the main limiting items we use to filter the logs. Each line is identified by debug, info, warning, or error and we can limit our search to certain types.

• Source is the individual module the debug line was created by. More on this will be covered in the LanGuard Services and Components.

• Description is the actual occurrence of the event, including the commands run, files edited or connections established.

Now, aimed with the fields knowledge, let's look at the next non-empty line:

2020-08-17,16:23:09,311,3,"#00000e40","#00000c80","info ","PatchAutodownload","CPatchAD::DownloadManager - Before FreeThreads. First Free Thread: 0, Remaining Threads: 5, HighPending: 0, NormalPending: 0, LowPending: 0"

1. First three fields define the date and time: 2020-08-17 16:23:09.311
2. Next field (Log Level) value - 3 - indicates that debug mode is enabled.
3. Next we see Process ID = #00000e40, and then Thread ID = #00000c80
4. Next is Event Type = "info". 
5. The Source field indicates that the Patch Autodownload module recorded this log message.
6. And finally, we see the Event Description, which in this case is nothing special, but when analyzing warnings, errors, or general process workflow, may provide important clues.