> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/activity/logging.md).

# Logging

Logs record scan and system events that are useful for troubleshooting. They are separate from final findings: a scan can produce useful logs even when it produces no vulnerabilities.

## When to Use Attack Logs

Use **Activity -> Attack Logs** when:

* a module or submodule failed;
* a scan is stuck or slower than expected;
* a browser session stopped working;
* a target blocked or rate-limited requests;
* an internal agent disconnected;
* an internal host or service was unreachable;
* a scheduled run did not start;
* you need scan evidence for review or escalation.

## What to Look For

| Symptom                | Log evidence to check                                                                         |
| ---------------------- | --------------------------------------------------------------------------------------------- |
| Browser session failed | validation errors, replay failures, expired auth, missing storage, verification URL mismatch. |
| Target blocked scanner | HTTP 403/429 patterns, WAF pages, captcha loops, rate-limit calibration failures.             |
| Internal agent issue   | disconnects, heartbeat gaps, job pickup failures, route or interface errors.                  |
| Module timeout         | max runtime cancellation, submodule timeout, long-running job status.                         |
| Queue delay            | scheduled/running state with delayed worker pickup.                                           |

## Filtering

Filter logs by time range, module, severity, and text search. Start with the module reference from **Activity -> Activity**, then narrow to the failing time window.