Raw Log Search Troubleshooting

Updated Aug 22, 2023

Troubleshoot Raw Log Search

This information provides solutions for common Raw Log Search issues in the Arctic Wolf® Unified Portal.

Search results do not match the query

Possible cause:

Resolution: Revise your query.

The query takes a long time to return results

Possible cause: Depending on the search criteria, some searches can take tens of minutes or more to return. Searches that use case insensitivity are usually slower.

Resolution: Revise your query.

Log lines that you expect to find in the search results are missing

Possible cause: Arctic Wolf might not be receiving data from the log source. Raw Log Search can only query data that is sent to Arctic Wolf for security monitoring.

Resolution:

  1. Check the Raw Log Sources page to see if this log source is registered with Arctic Wolf.

    Tip: See View log sources in the Raw Log Search User Guide for instructions.

  2. Follow the appropriate steps:

    • If the log source is not listed, configure the log source to send data to Arctic Wolf.

    Tip: See the Arctic Wolf Documentation for the relevant configuration guide. Contact your CST if you require assistance.

    • If the log source is listed:
      1. Go to the Tickets page.
      2. Search for a corresponding Log Source Disappeared alert.
      3. Follow the instructions in the ticket.
    • If there are no corresponding alerts, contact your CST for assistance.

Some log lines have the wrong timestamp

Possible cause: The Arctic Wolf Portal shows timestamps in either local time or UTC, depending on your display settings. If there is a mismatch between the actual timezone and the configured timezone for your log source, the data that Arctic Wolf receives may be offset by a number of hours. For example, if the timezone of a log source is EST and is configured to use local time, but the Arctic Wolf platform attributes the UTC timezone to this source, the timestamp for those log lines will be five hours in the future.

Resolution: If one of your log source timezones is offset, contact your CST to resolve the issue.

See also