Logs

bucketAV stores logs in a centralized location using CloudWatch Logs. You can configure the retention period for logs via the LogsRetentionInDays configuration parameter.

Query logs

To query the logs:

1. Visit the Amazon CloudWatch Console.
2. Double check the selected region (top right of the navigation bar).
3. Navigate to Logs → Logs Analytics via the sub navigation (lefthand side).
4. Select the bucketAV logs log group (if you followed the docs, the name starts with bucketav-Logs-) in the Search log groups... field.
5. Select a date range.
6. Enter the following query:

fields @timestamp, @message
| filter (@logStream like "/var/log/messages" and @message like "bucketav[") or @logStream like "/journald/bucketav.service"
| sort @timestamp desc

7. Click Run.

Learn more about the CloudWatch Logs Insights query syntax or discover the following sample queries.

All bucketAV logs

fields @timestamp, @message
| filter (@logStream like "/var/log/messages" and @message like "bucketav[") or @logStream like "/journald/bucketav.service"
| sort @timestamp desc

All system logs

fields @timestamp, @message, @logStream
| filter not ((@logStream like "/var/log/messages" and @message like "bucketav[") or @logStream like "/journald/bucketav.service")
| sort @timestamp desc

Get the 100 largest files scanned

fields @timestamp
| filter (@logStream like "/var/log/messages" or @logStream like "/journald/bucketav.service") and @message like "s3://" and @message like "[download="
| parse "s3://*/* * * [download=*,scan=*,size=*]" as bucket, key, version, msg, download, scan, size
| sort size desc
| limit 100

Get total file size scanned by bucket

fields @timestamp
| filter (@logStream like "/var/log/messages" or @logStream like "/journald/bucketav.service") and @message like "s3://" and @message like "[download="
| parse "s3://*/* * * [download=*,scan=*,size=*]" as bucket, key, version, msg, download, scan, size
| stats count() as files, sum(size) as total by bucket

Get all unscannable files

fields @timestamp, @message
| filter (@logStream like "/var/log/messages" or @logStream like "/journald/bucketav.service") and (@message like "could not be scanned because it is" or @message like "does no longer exist" or @message like "not downloadable" or @message like "access denied")
| sort @timestamp desc

Export logs for bucketAV support

In case bucketAV does not work as expected sending in the log messages is the easiest way for us to analyze and solve the issue.

1. Follow the instructions on how to query logs.
2. Use the All bucketAV logs by default in case bucketAV support did not ask to use a different query.
3. Press the Export results button and choose Download (CSV).
4. Sent the CSV file to hello@bucketav.com along with a description of your issue.

Remote access fallback

If no logs show up in CloudWatch Logs, you can connect to one of the bucketAV EC2 instances and run the following commands to get the logs:

Amazon Linux 2023

Requires bucketAV for Amazon S3 powered by ClamAV® version >= 2.21.0, bucketAV for Amazon S3 powered by Sophos® version >= 2.15.0, bucketAV for Cloudflare R2 powered by ClamAV® version >= 2.1.0, or bucketAV for Cloudflare R2 powered by Sophos® version >= 2.2.0.
To update to the latest version, follow the Update Guide.

sudo -i
journalctl -u bucketav.service

Amazon Linux 2

sudo -i
grep 'bucketav' /var/log/messages