Auditing and Monitoring Logs

PCMM2G records selected controller actions in operating-system logs and KAS audit logs.

Use these logs to review user access, configuration changes, project operations, firmware and recovery activity, and operating system behavior.

• 
  
• • Audit records support traceability and incident investigation.
  • They do not replace access control, secure network design, backups, vulnerability management, or other cybersecurity controls.

Locate Log Information

KAS Audit Logs

In the KAS Web server, open the KAS Application tab and select Log Data.

The audit folder contains files that group KAS runtime actions by functional area.

• Use KAS audit logs when investigating:
  • Application actions
  • Authentication attempts
  • Backup or restore actions
  • Configuration changes
  • Firmware operations
  • Project activity
• Select the log that matches the activity under investigation.
  • Correlate events by timestamp, user, source IP address, and result.
• See Log Data tab.

The audit logs are:

Filename	Description
config_audit.log	Contains configuration changes on the system, security, date/time settings, or network behavior.
kas_audit.log	Contains file management operations, firmware updates, and controller backup and restore.
network_audit.log	Contains webserver authentication attempts.
plc_audit.log	Contains PLC project modifications, downloads, uploads, and EtherCAT backup and restore.
user_audit.log	Contains user application changes such as application status and importing or exporting recipes.

Operating-system Logs

In the KAS Web server, open Diagnostics and select the OS Log Data sub-tab.

• This sub-tab provides access to selected Linux log files.
• Click the Refresh button to update the current file list.
• Log contents displayed through the Web server are read-only.
• Use operating-system logs for SSH access, authorization failures, service activity, startup events, system warnings, and operating-system diagnostics.

Information Needed	Web server Location
Controller crash information	Diagnostics > Crash Reports
KAS controller audit trail	KAS Application > Log Data > audit
Linux and security logs	Diagnostics > OS Log Data