Now we'll look at enticing queries and look at the log in the graph panels together.
First will prepare some queries.
So explore and I'll create a dashboard that shows VAR logs for both of my hosts same time module and
farm Sherlocks.
OK, so that's the logs that we'll see in our dashboard.
Very simple query job because VAR Logs is going to save that for after job because VAR logs.
The other one I want is to graph that, so I'll wrap that in.
I count over time one minute and finish that off.
And so now I can grab that.
So I'll use those to query my dashboard if I go now to write a new dashboard, create dashboard, add
an empty panel.
The first one will be a lock down the bottom there.
My low key query was job because bollocks, the Canada and there it is old school VAR logs OK supply
that will create another panel which will use the time series.
That's OK.
Low key and it'll be that query there over time.
One minute, so I'm saying lots of information there, all my log files that have been written on both
servers, both hosts on California and Moscow and overdue sat down to one hour, for example, because
that's pretty good online.
VAR logs again.
Excellent.
OK.
These descriptions here are quite long, so I could actually make those shorter by using a salmon grouped
by options some that I host phone.
I didn't click out of that, and those lines are now slightly shorter because it's not actually showing
tropicals bollocks anymore.
That's just an option you have.
That's just one reason for using some and the grouping down there.
So I'm happy with that apply that I can just reorder this a little bit.
OK, so now if I change my time, filter up there, whatever I see here, they're the related box down
there so I can zoom right into that.
Related logs goes even further and other related logs from both service.
I'll go back to one hour now to add an extra layer of querying code annotation queries over that now
with a nice log launch here.
There are occurrences of invalid use.
I would like to have those highlighted on that graph.
So while it's quite hard to actually see any here, there are likely to be some in there.
So what I can do is create an annotation query that is executed over the dashboard appear so dashboard
settings annotations.
Ad annotation query.
I'm going to call it invalid users, it's going to use a low key data source, it's enabled the color
will be read and my query will be job equals via logs.
Pipe equals invalid use antibodies.
Click out of that, that points.
So I got back to my dashboard and just turn it on and off.
We now start to see some highlights going on here, matching invalid user.
So if I zoom in to them, there's a little arrow just down here.
If you hover over that, it shows you the actual log line that it found.
I can see that again.
And these are all different logging attempts on my my secure server, mostly.
So this is normal for a server on internet.
Automatic scripts will try and log into your service.
OK, so straight away, that's pretty good networks.
Already, I can see if I zoom out to one hour.
There are a lot of attempts to log into my servers going on, so you might be happy with that graph.
But actually something about the syslog log by Zoom to these ones, for example, and I'll find one.
OK, so these log lines here, Bafana Lokey like same day level info, et cetera.
Query equals job VAR logs, invalid user So what's going on here is when you enter log you out queries,
they are all actually saved into the syslog as well.
So you can see here that says they have boxes log.
So any query I create is also being logged, so they're also being matched.
So for look at these again, most of those entries that we see, they're actually just me typing queries
through logical query logs.
Valid user down here.
Query VAR logs invalid user by zoom out.
I actually want to see these kinds of queries where it says Invalides, so I need to refine my annotation
query a little bit further.
Let's zoom in into these ones.
Further, let's find something in there.
OK, I want to look at those ones bit further.
If I look at that one there.
Query job via logs, invalid user that line down the bottom their job VAR logs showing invalid user.
I'll modify the filter to exclude something else returned in that line.
So something that might be useful to exclude could be where it says level.
It calls in for this.
So I'm going to exclude level equals info from the query.
So going back into annotation settings there annotations invalid user.
I would find this filter to be not a class two level because in fire.
So just click out of that so that it binds back to the dashboard now for Zoom back out to one hour,
not seeing as many annotations now as before.
So the annotations that I'm seeing now are going to be more explicit to the type I'm looking for.
They are the actual invalid user log in attempts to link back out to three hours, for example, they
go right back here.
So within those highlighted annotations there, none of those are actually the local queries that are
entered when I'm actually experimenting with the queries.
So be aware that that any query you type into the Explore tab is also being logged into the syslog.
Log on the server with this background.
That's Mega-fauna server.
So I I can save that.
I can call that my VAR log stable site and look at that over six hours if I want, or even over 15 minutes.
Excellent.