---
title: "Is There a Sample Script for Exporting Agent Log Data?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/53691384-3226-4916-b376-b4dcab0070eb"
language: "en"
last_updated: "2026-04-29T21:25:45.060Z"
---

# Is There a Sample Script for Exporting Agent Log Data?

This script provides a robust, paginated way to export Agent Log data from the Spirion platform.

To export **Agent Log** data via the Web API, you use a similar pattern to the Audit Log export but target the Agent-specific endpoints.

This script enables you to pull technical events (EPS, IDF, and IFS logs) from your distributed Agents for external analysis or SIEM ingestion.

## Python Sample Script for Agent Log Export

```py
import requests
import json
import time
from datetime import datetime, timedelta

# --- CONFIGURATION ---
TENANT_URL = "https://your-tenant.spirion.com"
API_TOKEN = "YOUR_BEARER_TOKEN"
LOG_FILE = "spirion_agent_logs.json"
STATE_FILE = "last_agent_log_timestamp.txt"
LIMIT_PER_PAGE = 500

def get_last_timestamp():
    try:
        with open(STATE_FILE, 'r') as f:
            return f.read().strip()
    except FileNotFoundError:
        # Default to the last 24 hours
        return (datetime.utcnow() - timedelta(days=1)).isoformat() + "Z"

def save_last_timestamp(timestamp):
    with open(STATE_FILE, 'w') as f:
        f.write(timestamp)

def export_agent_logs():
    last_seen = get_last_timestamp()
    # Endpoint for Agent Logs
    endpoint = f"{TENANT_URL}/api/v1/agentlogs"
    
    headers = {
        "Authorization": f"Bearer {API_TOKEN}",
        "Content-Type": "application/json"
    }
    
    all_events_processed = 0
    has_more_data = True
    current_start_date = last_seen

    print(f"Fetching Agent Logs since: {current_start_date}...")

    while has_more_data:
        params = {
            "startDate": current_start_date,
            "limit": LIMIT_PER_PAGE,
            "sort": "timestamp_asc"
        }

        try:
            response = requests.get(endpoint, headers=headers, params=params)
            response.raise_for_status()
            logs = response.json()

            if not logs or len(logs) == 0:
                has_more_data = False
                break

            # Append logs to local file
            with open(LOG_FILE, 'a') as f:
                for entry in logs:
                    f.write(json.dumps(entry) + "\n")
            
            all_events_processed += len(logs)
            last_batch_timestamp = logs[-1]['timestamp']
            
            if len(logs) == LIMIT_PER_PAGE:
                current_start_date = last_batch_timestamp
                print(f"Processed {all_events_processed} events. Paginating...")
                time.sleep(1) # Rate limiting
            else:
                save_last_timestamp(last_batch_timestamp)
                has_more_data = False

        except requests.exceptions.RequestException as e:
            print(f"Error exporting Agent Logs: {e}")
            has_more_data = False

    print(f"Export complete. Total Agent Log events: {all_events_processed}")

if __name__ == "__main__":
    export_agent_logs()
```

### Key Differences for Agent Logs vs. Audit Logs

-   **Endpoint:** The script uses `/api/v1/agentlogs`.
-   **Data Volume:** Agent logs are typically much higher volume than Audit logs because they record every scan heartbeat, file access error, and result shipment.
-   **Filtering by Agent:** You can add an `agentId` or `hostname` parameter to the `params` dictionary if you only want to export logs for a specific machine (e.g., `"agentId": "12345"`).

### Recommendations for Agent Log Exports

-   **Filter by Log Family:** If you only care about scanning errors, you can often filter the API request by the "Log Family" (e.g., `IDF` for search errors or `IFS` for shipping errors). This significantly reduces the amount of data you need to export and store.
-   **Monitor for "Access Denied":** When ingesting these logs into a SIEM, create an alert for the string `"Access Denied"`. This is the most common indicator that an agent's service account lacks the permissions needed to scan a specific target.
-   **Correlation IDs:** Each log entry in the export will contain a `correlationId`. Use this ID in your SIEM to link an agent-side error (e.g., "Failed to ship") with a console-side event, providing a full end-to-end view of the data pipeline.
-   **Storage Management:** Because Agent Logs are verbose, ensure your SIEM or storage location has a clear **retention policy**. You likely don't need "Heartbeat Success" logs from six months ago, but you *do* need "Access Denied" errors for at least 90 days for compliance auditing.

### Summary

This script provides a robust, paginated way to export **Agent Log** data from the Spirion platform. By automating this export, you can move technical troubleshooting and health monitoring into your organization's existing operational tools.