ESET Server Security for Linux – Table of Contents

ICAP access logs

Copy current article URL Share via email

This article (PDF) Whole documentation (PDF)

The access log records all requests that the Remote Scanning service (icapd) processes. The default log path is as follows:

/var/log/eset/efs/icap/access.txt

The access log records the ICAP requests that the Remote Scanning service (icapd) processed, including the scanned objects and the resulting actions or detection outcomes. Log files use UTF-8 encoding with LF line endings.

Enable access log

To enable ICAP access logging, in the application settings, navigate to Detection Engine > Remote scanning > ICAP > Access log and enable the Enable access log toggle.

icap_access

Log record format

Each log entry uses the following format:

time_stamp remote_ip icap_status_code "icap_request_line" http_status_code "http_request_line" bytes_recv bytes_resp "file_hash" "response_info" "response_desc" "threat_type" "threat_desc"

The following table describes each field:

Field	Description
time_stamp	Date and time the appliance received the request.
remote_ip	IP address of the client that sent the request.
icap_status_code	ICAP protocol status code returned for the request.
icap_request_line	Full ICAP request line.
http_status_code	HTTP status code associated with the request.
http_request_line	Full HTTP request line.
bytes_recv	Number of bytes received, in bytes.
bytes_resp	Number of bytes returned in the response, in bytes.
file_hash	Hash value of the scanned object.
response_info	Additional information about the response.
response_desc	Description of the response.
threat_type	Type of threat detected, if applicable.
threat_desc	Description of the detected threat, if applicable.

Automatic log rotation

Automatic log rotation is enabled by default. The system renames the current log file by appending the current date to the file path. For example:

/var/log/eset/efs/icap/access.txt.20260727

When automatic rotation triggers, the system performs the following actions:

•The active log file closes at midnight.

•The system automatically creates a new access.txt file.

•The system deletes old log files based on the configured retention period (default: 30 days).

Do not use automatic and manual log rotation at the same time. Use only one rotation method.

Manual log rotation

To trigger manual log rotation, rename the current log file, then send the SIGUSR2 signal to the icapd process.

1.Rename the file to ensures that the system creates a new log file when the process receives the signal.

mv /var/log/eset/efs/icap/access.txt /var/log/eset/efs/icap/access.txt.old

2.To ensure that pkill targets only the correct process owner, restrict matching to processes owned by the user eset-efs-icapd.

pkill -USR2 -U eset-efs-icapd icapd

Automate the manual log rotation

To automate manual log rotation on a recurring schedule, create a logrotate configuration file at the following path: /etc/logrotate.d/eset-efs-icap-access. The script uses the killall command to send the same signal shown above.

Configuration file example:

/var/log/eset/efs/icap/access.txt {
    weekly
    rotate 8
    nocreate
    missingok
    notifempty
    compress
    delaycompress
    postrotate
          killall -sUSR2 /opt/eset/efs/lib/icapd || true
    endscript
}

You can modify the following parameters in the configuration file:

•weekly: Frequency at which rotation runs.

•rotate 8: Number of rotated files that the system keeps.

To verify the configuration file without waiting for the scheduled rotation, run the following command. The -v flag displays verbose output, and the -f flag forces rotation regardless of the schedule.

sudo logrotate -vf /etc/logrotate.d/eset-efs-icap-access

˄˅