Is there any way to log individual HTTP requests to Fleet (i.e. POST request with URL and payload)? I have this setup and I'm not getting any logs written to /var/log/fleet, and I'm not even sure that's what those logs would include:

logging:
  json: true
activity:
  enable_audit_log: true
filesystem:
  audit_log_file: /var/log/fleet/audit.log
  result_log_file: /var/log/osquery/result.log

Those logs aren't enabled by default because there's the potential for a HUGE volume of logs. You can enable debug logging to get additional logs.

# This enables logging of the Fleet activity stream (<https://fleetdm.com/docs/using-fleet/audit-logs#audit-logs>)
# This log is a Fleet Premium feature
# For Fleet Community users, this data is available through the REST API (<https://fleetdm.com/docs/rest-api/rest-api#activities>)
activity:
  enable_audit_log: true
filesystem:
  # This is the path for the audit log (see above)
  audit_log_file: /var/log/fleet/audit.log
  # This is the path for the osquery results logs for scheduled queries (sent from the osquery agent)
  result_log_file: /var/log/osquery/result.log

The Fleet logs themselves are sent to

stdout

or

stderr

, so where you'll find them will depend on how you're running Fleet.

@Kathy Satterlee awesome, thanks. We're running it under systemd as a service, so we don't see that output.