Manage Logs

The following topic describes Tenable Nessus log files. Tenable Nessus log files are located in the following directories:

nessusd.dump

nessusd.dump is the Tenable Nessus dump log file used for debugging output.

To configure nessusd.dump:

1. Open the nessuscli utility.

2. Use the command # nessuscli fix --set setting=value to configure the following settings:

   Name	Description	Default	Valid Values
   Nessus Dump File Location (dumpfile)	Location of nessusd.dump, a log file for debugging output if generated. The following are the defaults for each operating system: Linux: /opt/nessus/var/nessus/logs/nessusd.dump macOS: /Library/Nessus/run/var/nessus/logs/nessusd.dump Windows: C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.dump	Nessus log directory for your operating system	String
   Nessus Dump File Log Level (nasl_log_type)	The type of NASL engine output in nessusd.dump.	normal	normal, none, trace, or full.
   Nessus Dump File Max Files (dumpfile_max_files)	The maximum number of the nessusd.dump files kept on disk. If the number exceeds the specified value, Tenable Nessus deletes the oldest dump file.	100	Integers 1-1000
   Nessus Dump File Max Size (dumpfile_max_size)	The maximum size of the nessusd.dump files in MB. If file size exceeds the maximum size, Tenable Nessus creates a new dump file.	512	Integers 1-2048
   Nessus Dump File Rotation Time (dumpfile_rotation_time)	Determines how often Tenable Nessus dump files are rotated in days.	1	Integers 1-365
   Nessus Dump File Rotation (dumpfile_rot)	Determines whether Tenable Nessus rotates dump files based on maximum rotation size or rotation time.	size	size — Tenable Nessusrotates dump files based on size, as specified in dumpfile_max_size. time — Tenable Nessus rotates dump files based on time, as specified in dumpfile_rotation_time.
   Use Milliseconds in Logs	When enabled, nessusd.messagesand nessusd.dumplog timestamps are in milliseconds. When disabled, log timestamps are in seconds.	no	yes or no

   For more information, see Advanced Settings.

nessusd.messages

nessusd.messages is the Tenable Nessus scanner log.

To configure nessusd.messages:

1. Open the agent command line interface.

2. Use the command # nessuscli fix --set setting=value to configure the following settings:

   Name	Description	Default	Valid Values
   Nessus Scanner Log Location (logfile)	Location where Tenable Nessus stores its scanner log file. The following are the defaults for each operating system: Linux: /opt/nessus/var/nessus/logs/nessusd.messages macOS: /Library/Nessus/run/var/nessus/logs/nessusd.messages Windows: C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.messages	Nessus log directory for your operating system	String
   Log File Maximum Files (logfile_max_files)	Determines the maximum number of nessusd.messages files that Tenable Nessus keeps on the disk. If the number of nessusd.messages log files exceeds the specified value, Tenable Nessus deletes the oldest log files.	Tenable Nessus — 100 Tenable Agent — 2	Integers 1-1000
   Log File Maximum Size (logfile_max_size)	Determines the maximum size of the nessusd.messages file in MB. If the file size exceeds the maximum size, Tenable Nessus creates a new messages log file.	Tenable Nessus —512 Tenable Agent — 10	Integers 1-2048
   Log File Rotation Time (logfile_rotation_time)	Determines how often Tenable Nessus messages log files are rotated in days.	1	Integers 1-365
   Log File Rotation (logfile_rot)	Determines whether Tenable Nessus rotates messages log files based on maximum rotation size or rotation time.	size	size — Tenable Nessus rotates log files based on size, as specified in logfile_max_size. time — Tenable Nessus rotates log files based on time, as specified in logfile_rotation_time.
   Use Milliseconds in Logs (logfile_msec)	When enabled, nessusd.messagesand nessusd.dumplog timestamps are in milliseconds. When disabled, log timestamps are in seconds.	no	yes or no

   For more information, see Advanced Settings.

www_server.log

www_server.log is the Tenable Nessus web server log.

To configure www_server.log:

You can configure log locations and rotation strategies for www_server.log by editing the log.json file. You can also configure custom logs by creating a new reporters[x].reporter section and creating a custom file name.

To modify log settings using log.json:

1. Using a text editor, open the log.json file, located in the corresponding directory:

   Operating System	Log Location
   Windows	C:\ProgramData\Tenable\Nessus\nessus\logs\<filename>
   macOS	/Library/Nessus/run/var/nessus
   Linux	/opt/nessus/var/nessus

2. For each log file, edit or create a reporters[x].reporter section, and add or modify the following parameters:

   Note: The following describe parameters in the log.json file, and whether Tenable recommends that you modify the parameter. Some parameters are advanced and you do not need to modify them often. If you are an advanced user who wants to configure a custom log file with advanced parameters, see the knowledge base article for more information.

   Parameter	Default value	Can be modified?	Description
   tags	response	no	Determines what log information the log includes. response — Web server activity logs Note: response is the only valid tag for www_server.log.
   type	file	not recommended	Determines the type of the log file.
   rotation_strategy	size	yes	Determines whether the log archives files based on maximum rotation size or rotation time. Valid values: size — Rotate the log based on size, as specified in max_size. daily — Rotate the log based on time, as specified in rotation_time.
   rotation_time	86400 (1 day)	yes	Rotation time in seconds. Only used if rotation_strategy is daily.
   max_size	Tenable Nessus: 536870912 (512 MB) Tenable Agent: 10485760 (10 MB)	yes	Rotation size in bytes. Only used if rotation_strategy is size.
   max_files	Tenable Nessus: 10 Tenable Agent: 2	yes	Maximum number of files allowed in the file rotation. The maximum number includes the main file, so 10 max_files is 1 main file and 9 backups. If you decrease this number, Tenable Nessus deletes the old logs.
   file	Depends on operating system and log file	yes	The location and name of the log file. See Manage Logs. If you change the name of a default Tenable Nessus log file, some advanced settings may not be able to modify the log settings.
   context	true	not recommended	Enables more context information for logs in the system format, such as backend.log.
   format	combined	not recommended	Determines the format of the output. combined — Presents output in a format used for web server logs. system — Presents output in the default operating system log format.

   The following are examples of a log.json file.

   Linux example

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "/opt/nessus/var/nessus/logs/www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": "/opt/nessus/var/nessus/logs/backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

   Windows example

   Note: The backslash (\) is a special character in JSON. To enter a backslash in a path string, you must escape the first backslash with a second backslash so the path parses correctly.

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "C:\\ProgramData\\Tenable\\Nessus\\nessus\\logs\\www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": "C:\\ProgramData\\Tenable\\Nessus\\nessus\\logs\\backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

   macOS example

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "/Library/Nessus/run/var/nessus/logs/www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": /Library/Nessus/run/var/nessus/logs/backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

3. Save the log.json file.

4. Restart the Tenable Nessus service.

   The Tenable Nessus updates the log settings.

backend.log

backend.log is the Tenable Nessus backend log.

To configure backend.log:

You can configure log locations and rotation strategies for backend.log by editing the log.json file. You can also configure custom logs by creating a new reporters[x].reporter section and creating a custom file name.

To modify log settings using log.json:

1. Using a text editor, open the log.json file, located in the corresponding directory:

   Operating System	Log Location
   Windows	C:\ProgramData\Tenable\Nessus\nessus\logs\<filename>
   macOS	/Library/Nessus/run/var/nessus
   Linux	/opt/nessus/var/nessus

2. For each log file, edit or create a reporters[x].reporter section, and add or modify the following parameters:

   Note: The following describe parameters in the log.json file, and whether Tenable recommends that you modify the parameter. Some parameters are advanced and you do not need to modify them often. If you are an advanced user who wants to configure a custom log file with advanced parameters, see the knowledge base article for more information.

   Parameter	Default value	Can be modified?	Description
   tags	log, info, warn, error, trace	yes	Determines what log information the log includes. response — Web server activity logs info — Informational logs for a specific task warn — Warning logs for a specific task error — Error logs for a specific task debug — Debugging output verbose — Debugging output with more information than debug trace — Logs used to trace output
   type	file	not recommended	Determines the type of the log file.
   rotation_strategy	size	yes	Determines whether the log archives files based on maximum rotation size or rotation time. Valid values: size — Rotate the log based on size, as specified in max_size. daily — Rotate the log based on time, as specified in rotation_time.
   rotation_time	86400 (1 day)	yes	Rotation time in seconds. Only used if rotation_strategy is daily.
   max_size	Tenable Nessus: 536870912 (512 MB) Tenable Agent: 10485760 (10 MB)	yes	Rotation size in bytes. Only used if rotation_strategy is size.
   max_files	Tenable Nessus: 10 Tenable Agent: 2	yes	Maximum number of files allowed in the file rotation. The maximum number includes the main file, so 10 max_files is 1 main file and 9 backups. If you decrease this number, Tenable Nessus deletes the old logs.
   file	Depends on operating system and log file	yes	The location and name of the log file. See Manage Logs. If you change the name of a default Tenable Nessus log file, some advanced settings may not be able to modify the log settings.
   context	true	not recommended	Enables more context information for logs in the system format, such as backend.log.
   format	combined system	not recommended	Determines the format of the output. combined — Presents output in a format used for web server logs. system — Presents output in the default operating system log format.

   The following are examples of a log.json file.

   Linux example

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "/opt/nessus/var/nessus/logs/www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": "/opt/nessus/var/nessus/logs/backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

   Windows example

   Note: The backslash (\) is a special character in JSON. To enter a backslash in a path string, you must escape the first backslash with a second backslash so the path parses correctly.

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "C:\\ProgramData\\Tenable\\Nessus\\nessus\\logs\\www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": "C:\\ProgramData\\Tenable\\Nessus\\nessus\\logs\\backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

   macOS example

   {

   "reporters": [

   {

   "tags": [

   "response"

   ],

   "reporter": {

   "type": "file",

   "rotation_strategy": "daily",

   "rotation_time": "86400",

   "max_size": "536870912",

   "max_files": "1024",

   "file": "/Library/Nessus/run/var/nessus/logs/www_server.log"

   },

   "format": "combined"

   },

   {

   "tags": [

   "log",

   "info",

   "warn",

   "error",

   "trace"

   ],

   "reporter": {

   "type": "file",

   "file": /Library/Nessus/run/var/nessus/logs/backend.log"

   },

   "context": true,

   "format": "system"

   }

   ]

   }

3. Save the log.json file.

4. Restart the Tenable Nessus service.

   The Tenable Nessus updates the log settings.

nessuscli.log

nessuscli.log is an audit trail and debug log for any operations performed using nessuscli.

Tenable recommends checking this log in the following scenarios:

• Troubleshooting Agent Linking — If you run nessuscli agent link and it fails, this log often gives more detail than the terminal output.

• Verifying Automation — If you use scripts to configure Tenable Nessus (for example, via Ansible or Bash), this log confirms if the commands were actually received and executed by the system.

• Auditing Change — If a setting (like listen_port or proxy_mode) was changed unexpectedly, this log can tell you when the command was run.