# Logs and alerts

Answers the question: Where do you look at device events?

## The log

The Audit section searches the security and network logs that Android itself keeps and hands to the server. The query is written in LogsQL, the period is chosen with the buttons, the source and level with the filters.

![Audit](https://docs.wyrd.link/assets/img/en/console-audit.png)

Logging is enabled per device, by a command from its page.

The security log covers the whole phone: boot, debugging, unlocks, the key store, installs. Wi-Fi and Bluetooth connection events stay on the phone. The network log covers work apps only.

The log store runs on the same machine as the Wyrd server. Events do not leave it.

## Alerts

Alert rules match events against a condition and raise a record when it holds. Rule types: failed unlock attempts, a device offline, vulnerabilities, a log match, a geofence.

![Dashboard](https://docs.wyrd.link/assets/img/en/console-dashboard.png)

The Dashboard section collects what needs attention: how many devices are online, which ones stopped connecting, which have open vulnerabilities.