Logs

The default location of logs is inside the /var/log/memgraph/ directory. That location can be configured using the --log-file configuration flag.

Memgraph tracks logs at various levels: TRACE, DEBUG, INFO, WARNING, ERROR, CRITICAL. By default, it is using the WARNING level, but you can change the level using the --log-level configuration flag or during runtime using the SET DATABASE SETTING "log.level" TO "TRACE";

The configuration set during runtime will be applied only for that session.

You can check the log level by running SHOW DATABASE SETTING "log.level"; query.

To access the logs from the Memgraph Lab interface, make sure to expose the port 7444 when starting Memgraph with Docker.

Access logs

If you installed Memgraph with Linux, logs can be found in the /var/log/memgraph directory.

If you installed Memgraph using Docker, the easiest way to access the logs is by having a named volume (opens in a new tab) on the /var/log/memgraph directory and checking its content. If you're not using a named volume, here are the steps to access the logs within the running Docker container:

docker ps

docker exec -it <CONTAINER_ID> bash

ls /var/log/memgraph

cat /var/log/memgraph/memgraph_2022-03-04.log

grep -v -E "SHOW STORAGE INFO|APP_INTERNAL_EXEC_VAR|SHOW INDEX INFO|SHOW CONSTRAINT INFO|SHOW TRIGGERS" /var/log/memgraph/memgraph_2022-03-04.log

docker cp  <CONTAINER_ID>:/var/log/memgraph/<memgraph_date>.log <memgraph_date>.log

C:\Users\Vlasta\Desktop>docker cp bb3de2634afe:/var/log/memgraph/memgraph_2022-03-04.log memgraph_2022-03-04.log

Hiding passwords (Enterprise)

To enhance security, it's crucial to ensure that sensitive information is not logged. In the example below we can see how passwords are masked in the Enterprise edition of Memgraph:

Original log (Community version):

SET PASSWORD TO 'newpassword' REPLACE 'oldpassword'

Masked log (Enterprise version):

SET PASSWORD TO '****' REPLACE '****'

All passwords are replaced with **** to prevent their exposure in the logs. This approach ensures that even if logs are accessed by unauthorized individuals, they won't be able to retrieve the actual passwords.

Audit log (Enterprise)

Memgraph supports all query audit logging. When enabled, the audit log contains records of all queries executed on the database. Each executed query is one entry (one line) in the audit log. The audit log itself is a CSV file.

All audit logs are written to <MEMGRAPH_DURABILITY_DIRECTORY>/audit/audit.log. The log is rotated using logrotate, so entries in the audit.log file are always the newest entries. Entries in audit.log.1, audit.log.2.gz, etc. are older entries. The default log rotation configuration can be found in /etc/logrotate.d/memgraph. By default, the log is rotated every day and a full year of entries is preserved. You can modify the values to your own needs and preferences.

Format

The audit log contains the following information formatted into a CSV file:

<timestamp>,<address>,<username>,<query>,<params>

For each query, the supplied query parameters are also logged. The query is escaped and quoted so that commas in queries don't affect the correctness of the CSV. The parameters are encoded as JSON objects and are then escaped and quoted.

Example

This is an example of the audit log:

1551376833.225395,127.0.0.1,admin,"MATCH (n) DETACH DELETE n","{}"
1551376833.257825,127.0.0.1,admin,"CREATE (n {name: $name})","{\"name\":\"alice\"}"
1551376833.273546,127.0.0.1,admin,"MATCH (n), (m) CREATE (n)-[:e {when: $when}]->(m)","{\"when\":42}"
1551376833.300955,127.0.0.1,admin,"MATCH (n), (m) SET n.value = m.value","{}"

We can see that all of the queries were executed from the loopback address and were executed by the user admin. The executed queries are:

 Query                                            | Parameters
--------------------------------------------------|-----------
MATCH (n) DETACH DELETE n                         | {}
CREATE (n {name: $name})                          | {"name": "alice"}
MATCH (n), (m) CREATE (n)-[:e {when: $when}]->(m) | {"when": 42}
MATCH (n), (m) SET n.value = m.value              | {}

Parsing the log

If you wish to parse the log, the following Python snippet shows how to extract data from the audit log:

import csv
import json
 
with open("audit.log") as f:
    reader = csv.reader(f, delimiter=',', doublequote=False,
                        escapechar='\\', lineterminator='\n',
                        quotechar='"', quoting=csv.QUOTE_MINIMAL,
                        skipinitialspace=False, strict=True)
    for line in reader:
        timestamp, address, username, query, params = line
        params = json.loads(params)
        # Rest of your code that processes the logs.

Flags

Use the following flags to configure audit logging in Memgraph.