Raw logs from wazuh dashboard

[Jayakrishnan]

Hello All,

I was wondering if I could get to see the raw logs coming from agents or through syslog connection in the wazuh dashboard. For some events I was able to see it in a field called 'full log' in the dashboard when the alert is generated, but for other log's alerts there is no such field as full log. Can someone explain what is happening?

Thanks

Jayakrishnan

[Alexander Bohorquez]

Hi Jayakrishnan,

Thank you for using Wazuh! 

By default, the "full_log" field is added to the alerts and this would be the original log that is processed by the Wazuh-manager.

There are certain cases in which the rules with which the alert is generated contain the "no_full_log" option and this means that when it is generated it does not include raw log in the alert and you cannot verify it from the WUI. 

I leave you the reference documentation and I hope this clarifies your doubt: https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html#options.

Please let us know if you have any other questions.