---
title: "Action: write to log"
description: "Keep a log entry automatically when an event happens in Guardian."
product: "Guardian"
edition: "Classic"
type: "workflow"
url: "https://docs.cloudhouse.com/guardian/classic/control/events/actions/write-to-log/"
---
# Action: write to log

Keep a log entry automatically when an event happens in Guardian. For example, you might want to keep a record of scan or policy failures for future reference. You can do that using the **Write to Log** action. This action lets you make note of specific events in Guardian's internal service logs. These service logs are then sent to a syslog collector of your choice.

Applies to: `Guardian Classic`

!!! note

    The **Write to Log** action requires Guardian to be connected to an external syslog collector. To connect to a syslog collector, speak with your Guardian Representative.

![Write to log overview](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/events/write-to-log-overview.png)

!!! tip

    For an overview of actions in Guardian, including more options available to choose from, see [Actions](https://docs.cloudhouse.com/guardian/classic/control/events/actions/actions/index.md).

## Action Settings

When configuring a **Write to Log** action, the following settings are presented:

**Action name** field
:   A unique name for the action. This name is how you will identify this action among all others configured in your Guardian instance, so ensure it is descriptive. For example, 'Failed Policy Log' and not simply 'Policy Log'.

**Message** field
:   The message to record in Guardian's internal service log when the action is triggered. To make your messages dynamic, you can include variables in this field.  Variables are pieces of text that Guardian will replace with relevant data. For example, you could use the variable `{{ timestamp }}` to include the time that the action was triggered. Or, you could use the variable `{{ success }}` here to indicate whether a policy check passed or failed.

These settings are configured when adding a new action, and they can also be edited at any time through the **Actions** tab (**Control** > **Events** > **Action**). To edit an action from the **Actions** tab, click the **Ellipsis** (![Ellipses](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/buttons/ellipses.png)) and select **Edit**. Once you have made your edits, click **Done** to save them.

## Add a write to log endpoint action

You can add a new **Write to Log** action from any saved view in your Guardian instance. Each saved view represents a specific event determined using a query on the **Events** page. The saved view you select during this configuration determines the corresponding event that triggers your new action. For more information, see [Saved Views](https://docs.cloudhouse.com/guardian/classic/control/events/events/index.md#saved-views).

To add a Write to Log action, complete the following process:

!!! tip

    For help completing any of the following fields, refer to their respective descriptions in the **Action Settings** table above.

1. Navigate to the **Events** tab (**Control** > **Events**).
2. Click the **Saved Views** button at the top of the page. The **Saved Views** side panel is displayed.

    ![Screenshot showing the Guardian Events page with a border around the Saved Views button.](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/events/add-action-01.png)

3. Select the event you want to trigger your new action. The saved view for that event is displayed.
4. Click the **Actions** tab to display all existing actions configured for this event.
5. Click the **Add Action** button. The **Add New Action** page is displayed.

    ![Screenshot showing the Guardian Events page with a border around the Actinos tab and the Add Action button.](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/events/add-action-02.png)

6. Click **Write to Log**. The required fields are displayed.
7. Enter an **Action Name**.
8. Enter a **Message**.

    !!! tip

        Once you have entered a message, you can view a preview of the message that will be sent as part of this action. You can use this preview to test any variables you may have used. To view a preview message, click **Preview**.

    ![Write to log preview](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/events/write-to-log-preview.png)

9. Click **Done**.

Now, a confirmation dialog is displayed and you are redirected to the **Actions** tab for your selected saved view. Here, you can view your new action. To disable, edit, or test the action, click the **Ellipsis** (![Ellipses](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/buttons/ellipses.png)) and select the appropriate option.