飞连为您提供全面的日志审计能力，覆盖身份、网络、终端及通用协作四大维度。管理员不仅可以在线查看分散在各业务模块的活动记录，还可以通过日志外发功能，将审计数据实时推送至企业自有的日志服务器（Syslog）或 Elasticsearch 集群，以满足等保合规存放、统一安全分析或长周期溯源的需求。

全场景业务日志审计分布与配置索引 #

飞连日志涵盖了企业身份认证、网络访问准入、终端安全合规等全链路环节。下表展示了飞连全量日志的分布与详情，管理员可根据此表：

• 快速定位：明确各类业务日志在管理后台的具体查询路径。
• 评估范围：了解飞连在不同业务场景下的审计深度与记录内容。
• 管理数据周期：根据各日志类型的默认保留时长，结合企业合规需求，判断是否需要开启外发。如需外发，请参考配置日志外发说明。

配置日志外发 #

日志外发是实现数据私有化存储与长效审计的关键步骤。飞连支持按业务场景将结构化日志实时同步至企业私有化存储或安全分析平台。管理员可根据实际需求，结合上表中各场景日志的存储和外发支持情况，针对性地开启外发任务。

前置准备 #

在配置之前，请确保您的接收端服务器满足以下网络条件：

• 连通性：您的 Syslog 服务器或 Elasticsearch 集群必须具有公网 IP，或通过专线与飞连云端互通。
• 防火墙策略：请在您的企业防火墙上放行来自飞连云端服务器的入站流量，目标端口取决于下方的配置。

操作步骤 #

1. 登录管理后台。

2. 在左侧导航栏，选择日志审计。

3. 在日志审计页面的右上角，单击日志外发管理。
   

4. 在日志外发管理页面的场景列表中，选择需要外发的日志类型，并单击右上角的编辑，进入协议参数配置。
   

5. 您可以同时配置多种协议，请根据接收端类型填写参数。

   • 配置 Syslog 协议
     

     • 开启协议：点击 Syslog 卡片右上角的开关按钮。

     • 地址配置：

       参数	说明
       传输协议	在地址栏左侧，点击按钮选择 TCP（推荐，更可靠）或 UDP。
       地址	填写指向 Syslog 程序所在服务器的 IP 地址和监听端口。请按照 IP:端口 的格式输入，例如 192.168.1.50:514 或 log.example.com:6514。

   • 配置 Elasticsearch 协议
     

     • 开启协议：点击 Elasticsearch 卡片右上角的开关按钮。

     • 参数配置：

       参数	说明
       服务地址	指向 Elasticsearch 服务的完整 URL 连接地址。请务必包含协议头（http/https）及端口号，例如http://192.168.1.100:9200 或 https://es.example.com:9200 。
       索引名称	用于存储日志的 Index Name，建议使用小写字母和下划线。示例：feilian_device_logs
       用户名/密码	请输入具有该索引写入权限的用户名和密码。

6. 确认参数配置无误后，点击页面右上角的保存使配置生效。

7. 开启开关后，系统将开始推送新产生的日志，开启前的历史日志不会被同步。

附录：日志外发字段格式 #

DLP 相关日志的外发字段说明请参考DLP 日志外发字段格式。

管理员操作日志 #

<14>1 2024-10-24T21:11:08+08:00 - xxx 2511297 - - {
        "tenant_id": "b7******",
        "x_key": "admin_audit_log",
        "user": {
                "open_id": "ou_XqQW******",
                "username": "张三",
                "user_email": "zhangsan@example.com",
                "departments": ["xxx/RD"]
        },
        "env": {
                "os": "web",
                "client_ip": "10.x.x.x",
                "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
        },
        "option": {
                "module": "101",
                "module_message": "动态控制",
                "sub_module": "1",
                "sub_module_message": "动态决策",
                "action": "admin/dynamic_security/engine/groups/1615",
                "action_message": "更新规则组"
        },
        "events": [{
                "status": "success",
                "model": "dynamic_rule_group",
                "model_message": "规则组",
                "action": "update",
                "action_message": "更新了规则组",
                "updates": [{
                        "ids": null,
                        "updates": {
                                "策略名称": {
                                        "from": "",
                                        "to": "审计规则"
                                },
                                "触发方式": {
                                        "from": null,
                                        "to": "应用风险"
                                }
                        }
                }]
        }, {
                "status": "success",
                "model": "dynamic_rule_group",
                "model_message": "规则组",
                "action": "update",
                "action_message": "更新了规则组",
                "updates": [{
                        "ids": null,
                        "updates": {
                                "启用策略": {
                                        "from": "",
                                        "to": "审计规则"
                                }
                        }
                }]
        }],
        "success": true,
        "timestamp": 1729775468
}

VPN 连接日志 #

<14>1 2023-05-24T12:48:48+08:00 - xxx 19461 - - {
        "x_key": "vpn_connect_log",
        "open_id": "ou_dV***zYA",
        "user_name": "张三",
        "user_email": "zhangsan@example.com",
        "client_ip": "10.10.*.*",
        "device_id": "641162*****58ff43f991312093",
        "device_os": "Mac 13.2.1",
        "device_model": "Apple/MacBookPro16,2",
        "vpn_id": 1,
        "vpn_ip": "10.*.*.*",
        "connect_time": "2023-05-24T12:48:45+08:00",
        "app_version": "Mac v2.1.12",
        "option": "connect"
}

VPN 访问日志 #

<14>1 2023-05-24T12:58:43+08:00 - xxx 13643 - - {
        "x_key": "vpn_conntrack",
        "user": "USER_ou_dV1jLvVzYA",
        "uip": "10.10.*.*:55299",
        "sip": "10.241.*.*",
        "dip": "142.251.*.*",
        "sport": "63031",
        "dport": "443",
        "protocol": "tcp",
        "host": "www.example.com",
        "action": "accept",
        "timestamp": "1684904321"
}

员工 Wi-Fi 连接日志/访客 Wi-Fi 连接日志/哑终端网络连接日志 #

<14>1 2023-05-24T12:48:48+08:00 - xxx 19461 - - {
        "x_key": "wifi_connect_employee",
        "radius_id": 1,
        "connect_time": "2006-01-02T15:04:05Z07:00",
        "disconnect_time": "2006-01-02T15:04:05Z07:00",
        "connection_result": 1,
        "connection_group_id": "DEFAULT",
        "connection_ip": "10.0.0.*",
        "account_id": 1,
        "account_username": "zhangsan",
        "account_type": 1,
        "device_id": "0000000000",
        "device_name": "xxxxx",
        "calling_station_id": "3a:af:28:df:f8:79",
        "called_station_id": "20:4c:03:2b:30:6c",
        "creators": "1",
        "creators_ex": [{
                "open_id": "ou_xxx",
                "user_name": "张三",
                "user_email": "zhangsan@example.com"
        }],
        "remark": "",
        "option": "connect"
}

员工登录日志 #

<14>1 2023-05-24T12:38:32+08:00 - xxx 19461 - - {
        "x_key": "employee_login",
        "open_id": "ou_dV1**zYA",
        "user_name": "张X",
        "user_email": "zhangx@example.com",
        "client_ip": "10.10.*.*",
        "user_agent": "Mac/2.1.12(CorpLink/2.1.12 (darwin; Mac 13.2.1; zh))",
        "app_version": "2.1.12",
        "device_model": "Apple/MacBookPro16,2",
        "events": "[{\"success\":true,\"error_code\":\"\",\"error_message\":\"\",\"error_message_en\":\"\",\"name\":\"users\",\"action\":\"logout\",\"changes\":[{\"ids\":[2198],\"attrs\":null}]}]",
        "action": "logout",
        "success": true,
        "timestamp": 1684903112
}

动态控制日志 #

<14>1 2023-05-24T13:05:05+08:00 - xxx 19461 - - {
        "x_key": "dynamic_engine",
        "id": "738e8595-ff45-4343-8326-bb3***088",
        "open_id": "ou_dV1***zYA",
        "username": "张三",
        "user_email": "zhangsan.9612@example.com",
        "did": "62c24a*****17be079189b968bb7d7",
        "trigger": "period_5_min",
        "trigger_label": "",
        "action_key": "wifi-device-downgrade",
        "timestamp": 1684904700,
        "action_record_type": 1,
        "context": {
                "user_id": 2198,
                "user_agent": "",
                "did": "62c24a3***b968bb7d7",
                "ip": "",
                "event": {},
                "params": {
                        "user_id": 21 ** 8
                },
                "result": null
        },
        "is_manual": false,
        "undo": false,
        "result_code": 0,
        "group_id": 49,
        "rule_id": 406
}

终端防病毒-病毒查杀日志 #

<14>1 2023-05-24T13:10:14+08:00 - xxx 19461 - - {
        "x_key": "anti_virus",
        "event_id": "xxxx",
        "open_id": "xxx",
        "username": "",
        "user_email": "example.xxx.cn",
        "mobile": "",
        "timestamp": 17012345678,
        "report_time": 17012345678,
        "config_key": "xxx",
        "config_name": "xxx",
        "device_ip": "10.0.*.*",
        "device_id": "xxxxxxxx",
        "scan_mode": "realtime_scan",
        "scan_scene": "sensitive_file_protect",
        "scan_id": "xxx",
        "threat_object_flag": "av_object_file",
        "threat_object_id": "c:\users\mimikatz.exe+7862ac21eb3****247c188c5f8179f",
        "threat_file_path": "",
        "threat_file_hash": "xxx",
        "threat_file_size": 123,
        "threat_file_type": "win32exe",
        "process_name": "",
        "threat_type": "virus",
        "raw_malware_name": "Generic.Trojan.Mimikatz.Marte.!s!.A.301958EE",
        "threat_level": 1,
        "remediation": "remind_only"
}

设备信息日志 #

<14>1 2023-05-24T13:10:14+08:00 - xxx 19461 - - {
        "x_key": "device_info",
        "did": "668d9d86e6f****8a98e62725",
        "device_name": "JWVQRXWYXL",
        "os": "Mac",
        "os_ver": "14.6.1",
        "os_model": "macOS 14.6.1",
        "os_detail_version": "23G93",
        "app_ver": "3014",
        "brand": "Apple",
        "model": "Mac15,6",
        "language": "en-US",
        "client_ip": "10.10.*.*",
        "mac_addrs": "[\"4e:80:b2:60:15:8f\",\"66:6e:fe:47:42:2c\",\"66:6e:fe:47:42:2d\",\"a2:a9:97:42:15:e0\",\"36:0c:ed:a4:76:c0\",\"80:a9:97:42:15:e0\",\"66:6e:fe:47:42:0c\",\"36:0c:ed:a4:76:c4\",\"36:0c:ed:a4:76:c8\",\"66:6e:fe:47:42:0d\"]",
        "serial_number": "JWVQRXWYXL",
        "created_at": "2024-07-16T15:31:57+08:00",
        "updated_at": "2024-08-26T17:07:07+08:00",
        "is_live": true,
        "device_status": 1,
        "device_info": {
                "product_id": "",
                "serial_number": "JWVQRXWYXL",
                "memory_total": 36864,
                "memory_available": 11619,
                "disk_total": 471482,
                "disk_available": 385065,
                "cpu_model": "Apple M3 Pro",
                "cpu_serial_number": "",
                "gpu_model": "Apple M3 Pro",
                "nic_type": "Wi-Fi  (0x14E4, 0x4388)",
                "login_user": "admin",
                "is_vm": false,
                "nic_detail_list": [{
                        "nic_type": "en2",
                        "mac_addr": "36:0c:ed:a4:76:c4",
                        "active": false,
                        "description": "en2",
                        "has_traffic": false,
                        "ipv4": "",
                        "ipv6": [],
                        "is_default": "0"
                }, {
                        "nic_type": "en4",
                        "mac_addr": "66:6e:fe:47:42:0c",
                        "active": false,
                        "description": "en4",
                        "has_traffic": false,
                        "ipv4": "",
                        "ipv6": [],
                        "is_default": "0"
                }],
                "os_install_date": 1720556814,
                "ssd_serial_numbers": ["0ba0225c433cd629"]
        },
        "ext_attr_list": [{
                "id": 86,
                "def": {
                        "id": 86,
                        "name": "是否是公司设备",
                        "key": "是否是公司设备",
                        "desc": "",
                        "type": 3,
                        "is_required": false,
                        "is_unique": false
                },
                "value": true
        }],
        "groups": [{
                "id": 6,
                "name": "公司资产",
                "mode": 2
        }, {
                "id": 107,
                "name": "设备分组示例",
                "mode": 2
        }],
        "user_id": "ou_PO1***P2Va",
        "full_name": "username",
        "mobile": "",
        "email": "abc@def.com",
        "department_id": "od_yN***vzz",
        "status": 1,
        "department_path": "example/xxxx/yyyy",
        "icon_url": "https://xxxxxxx",
        "roles": [{
                "name": "Employees",
                "id": "or_N1**EV"
        }],
        "third_party_user_id": "92**3e1"
}

CPE 访问日志 #

<14>1 2023-05-24T13:10:14+08:00 - xxx 19461 - - {
        "x_key": "cpe_conntrack",
        "sip": "169.254.*.*",
        "dip": "100.64.*.*",
        "sport": "59618",
        "dport": "80",
        "protocol": "tcp",
        "host": "100.64.*.*",
        "action": "continue",
        "timestamp": "1752837441",
        "user": "*",
        "identity": "*",
        "uip": "111.19.*.*:6192", 
        "rule": "rule-1"
}

应用网关访问日志 #

<14>1 2025-11-28T15:24:10+08:00 - xxx 9493 - - {
        "tenant_id": "00000000",
        "x_key": "agw_access_log",
        "sip": "114.251.*.*",
        "sport": "63074",
        "protocol": "HTTP/1.1",
        "schema": "https",
        "method": "POST",
        "host": "fakebaidu.com",
        "uri": "/EWS/Exchange.asmx",
        "intranet_ip": "127.0.0.1",
        "referer": "",
        "user_agent": "AppleExchangeWebServices/835 ExchangeSync/2007",
        "status": 401,
        "size": 0,
        "duration": 0.01093102,
        "level": "error",
        "timestamp": 1764314646,
        "trace_id": "fb4d8abe-d2b1-4a47-b848-c2abf5******",
        "user": {
                "open_id": "ou_JwBN******",
                "username": "张三",
                "user_email": "zhangsan@example.com",
                "departments": ["测试"]
        },
        "api_resource_groups": [{
                "id": 5,
                "name": "全部资源",
                "app_id": 37,
                "api_resources": [{
                        "headers": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
                        "path": "/*"
                }]
        }],
        "app_name": "网关测试",
        "app_gateway_name": "测试节点"
}

API 调用日志 #

<14>1 2024-10-24T21:11:08+08:00 - xxx 2511297 - - 
{
  "tenant_id": "********",
  "x_key": "openapi_request_log",
  "timestamp": 1770985595105,
  "create_time": 1770985599746313000,
  "request_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "user_agent": "Mac/2.1.12(CorpLink/2.1.12 (darwin; Mac 13.2.1; zh))",
  "request_content_type": "application/json",
  "response_content_type": "application/json; charset=utf-8",
  "client_ip": "xxx.xxx.xxx.xxx",
  "method": "POST",
  "canonical_path": "/api/open/v1/user/batch_create",
  "execution_time": 1634,
  "request_path": "/api/open/v1/user/batch_create?department_id=od_********",
  "access_key_id": "*",
  "http_status": 200,
  "error_message": "参数错误",
  "error_code": 40000,
  "request_payload": "{\"email\":\"test_user@example.com\",\"mobile\":\"138********\"}",
  "response_body": "{\"code\":40000,\"action\":\"alert\",\"message\":\"参数错误\"}",
  "flags": 12,
  "is_success": false
}

FAQ #

日志外发是实时外发吗？ #

正常情况下，日志会在其产生后的 1 分钟内进行外发。若因用户操作停止或网络异常，则会在工作任务恢复后从上次外发成功的最后一条日志开始。若为首次配置，仅外发最新日志，不会追溯到之前的历史日志。

网络异常时，日志外发会重发吗？ #

当遇到网络错误时，暂无重试次数上限，请确保网络环境良好。

• 对于 ElasticSearch 外发模式，若ElasticSearch服务返回参数错误，则会丢弃此日志，不再重试。
• 对于 SYSLOG UDP 外发模式，由于 UDP 协议无法保证通信成功，因此始终只会发送一次，不再重试。