Log File Streaming writes Files.com audit and activity logs to files on your site at a configured interval. Logs are delivered as JSON or CSV files and stored in selected destination folders. Use this approach for workflows that rely on file-based access, scheduled processing, long-term retention, or offline analysis.

For workflows that require real-time monitoring and alerting within a SIEM platform, Files.com offers separate SIEM integrations. These integrations deliver audit and activity logs directly to supported SIEM platforms in batches every 60 seconds, rather than writing them to files at the Log File Streaming interval.

How Log File Streaming Works

When Log File Streaming is enabled, Files.com collects the selected log types during each configured output interval. At the end of the interval, all collected entries are written to one or more files in the destination folder. The destination folder can be a folder on Files.com or a folder backed by a configured Remote Server. Each file contains all log entries generated for a specific log type during that time window.

Files are written once at the end of each interval and are not modified again by Files.com. Any subsequent activity is written to new files in later intervals. Files are not compressed and contain only complete log records. This allows files to be processed safely as soon as they appear, without concern for partial records or changing data.

Downstream systems often detect new log files by polling. Because files are created at a predictable interval, many workflows periodically list the contents of the destination folder using file access methods or APIs, and process files based on their timestamps or naming patterns.

For event-driven processing, use Files.com Webhooks to notify external systems when new files are created.

File-Based Processing and Retention

An analytics job can read completed JSON or CSV files from the destination folder and track which filenames it has already ingested. Choose an output interval that fits the job's schedule. Receiving the file establishes that the log batch was written; the downstream system's ingestion records establish whether it processed that batch.

For historical review, retain the output under the destination's permissions and retention policy. Files.com does not modify a written batch, but writing a file does not make it immutable or protect it from other accounts with change permissions. CSV output supports spreadsheet review, while JSON suits tools that consume structured records.

If network policy prevents direct SIEM ingestion, choose a destination and access method the receiving environment permits, such as an approved Remote Server Mount or scheduled file retrieval. File delivery still needs a permitted connection to that location; it does not bypass network controls.

Supported Log Types

Log File Streaming supports the log categories available for ongoing delivery. Only selected categories are written to files. Use that inventory to identify the records and their developer references before configuring a stream.

Log File Streaming Configuration

To configure a log file stream, provide a name, select destination folders, choose a file format, set an output interval, and select the log types to include.

Destination folders determine where log files are written and how they can be accessed, retained, or processed. Destination folders can be folders on Files.com or folders on Remote Server Mounts. Use a remote server mount when logs need to be stored outside the Files.com site, including when logs are processed by external analytics pipelines or must reside in a specific storage environment to meet internal retention or access requirements.

Each log type can be configured to write to its own destination folder, or multiple log types can be written to a single folder. This provides flexibility in how logs are organized, depending on how they will be accessed, ingested, or processed downstream.

The output interval controls how often log files are created and can be set between 5 and 360 minutes. By default, the interval is 60 minutes. For example, when the interval is set to 60 minutes, log files are written every 60 minutes and include all events generated for each selected log type during the preceding 60-minute window. Shorter intervals produce smaller, more frequent files, while longer intervals produce larger files containing more entries.

File Formats and Naming Conventions

Log File Streaming supports JSON and CSV formats. The same log data is written regardless of format, and the choice depends on how the files will be consumed.

Log files follow a consistent naming pattern in the form [LogType]-[Timestamp].[extension]. The timestamp represents when the file was created and can be used to order files chronologically. Including the log type in the file name allows different categories of logs to be processed independently. File extensions reflect the selected format, either .json or .csv.

When a Log File Stream is created or updated and then enabled, a small test file is written to the selected destination folder. This file is used to validate that the configuration is correct and that the destination folder is accessible. Subsequent files contain actual log data generated during each output interval.