# Logs

> Search, filter, live-tail and export normalised security events in Vigilbase OS, and read completeness notes.

Source: https://docs.vigilbase.com/os/logs

**Logs** is where you search the events Vigilbase has collected from your providers. Every event is normalised into a common shape and keeps a link to its raw payload. Open it from the sidebar or press `g` then `l`. You need the `logs.query` permission.

## Search

Type in the search box, or use `field:value`. The **Search syntax** help in the search box lists every option.

| Search | Finds |
|---|---|
| `actor:alice@example.test` | Exact match |
| `action:authentication.*` | Prefix match |
| `-outcome:success` | Excludes a value |
| `severity:>=60` | Numeric comparison (severity and port only) |
| `level:high,critical` | Any of several values |
| `host:"vpn gw"` | Quoted value |

Other words search the action, category and display names. Fields you can use are `action`, `outcome`, `level`, `severity`, `provider`, `dataset`, `category`, `actor`, `target`, `device`, `entity`, `ip`, `src`, `dst`, `port`, `host`, `country` and `event`.

Choose **Filters** to refine by provider, dataset, level, outcome, action, country, source IP or entity, then choose **Apply filters**.

By default Logs shows **Activity**: sign-ins, admin and privilege changes, token grants, configuration changes, network events and findings. Choose **All events** to include inventory and configuration snapshots.

## Read the results

- **Events over time** is a histogram of matching events. Select a bar to zoom to it.
- Choose **Columns** to show or hide columns such as **Level**, **Source**, **Timestamp**, **Asset**, **Country**, **Action** and **Message**.
- Expand a row to see the event. **Normalised** shows the common fields; **Raw JSON** shows the provider payload as text, with its SHA-256 hash. Sensitive fields are redacted unless your role allows them.
- From an expanded row, **Open entity** opens the entity in [Security Fabric](https://docs.vigilbase.com/os/security-fabric), **Pivot** adds a value to the search, and **Copy event ID** copies the ID.
- **Evidence & provenance** shows the connection, dataset, ingest time, parser, quality flags and retention for the event.

Searches over older data can run in the background. You can keep working, or choose **Cancel**.

## Completeness

Every result says how complete it is: **Complete for this range**, or a note that counts are approximate or not exact. Open the details to see feed gaps, late arrivals, parser failures, sampling and data outside full retention.

No events in a range is not proof that nothing happened. If a feed was missing or behind, the result says so.

## Live tail

Choose **Live tail** to watch matching events arrive. You need the `logs.live_tail` permission. Field filters apply to live tail; free text does not. Live tail pauses while you scroll; choose **Show new events** to catch up, or **Stop live tail** to return to search. Live events are not a completeness guarantee.

## Export

Choose **Export** to export the current results. You need the `logs.export` permission. Large exports run in the background. When the export is ready, choose **Download** before the link expires. Exports are recorded in the audit log.