Technical Tip: Exporting audit logs to CSV from backend

[koolishami]

Description	This article provides detailed steps for exporting audit logs stored in the PostgreSQL database to a CSV file for backup, review, or analysis purposes.
Scope	FortiSOAR.
Solution	To export audit logs from the backend, execute the following command as the root user: env PGPASSWORD=$(csadm license --get-device-uuid) psql -U cyberpgsql -d gateway -c "\COPY auditlogs TO '/tmp/auditlogs.csv' CSV HEADER" Explanation: This command connects to the gateway PostgreSQL database using credentials retrieved dynamically. The \COPY command exports the contents of the auditlogs table to a CSV file with headers. The file will be saved in the /tmp directory as auditlogs.csv. This output path can be customized as needed (for example, /opt/exports/auditlogs.csv). Notes: Execution time may vary depending on the volume of audit logs stored in the database. Ensure there is sufficient disk space in the target directory before running the export. Use tools like scp or sftp to transfer the exported file securely to another system if needed. If audit log retention policies are configured, only available data within the retention window will be exported. Example (Custom Output Path): env PGPASSWORD=$(csadm license --get-device-uuid) psql -U cyberpgsql -d gateway -c "\COPY auditlogs TO '/tmp/auditlogs_$(date +%F).csv' CSV HEADER" This creates a dated CSV file in a custom export folder.