Logging

Kismet has a centralized logging engine which supports many formats of logs.

Streaming logs like PCAP-NG also integrate with the streams API

List available log types

DESC

Fetch a list of all available log drivers.

Each logging driver handles a log output format.

ROLES
readonly
URI
/logging/drivers.json
/logging/drivers.ekjson
/logging/drivers.prettyjson
METHODS
GET

List active logs

DESC

List enabled and active logs

After 2026-10-R1, each log has kismet.logfile.rotate_overdue_since: the time (unix seconds) the kismetdb log’s next file was due but hasn’t been started yet, or 0 when it isn’t late.

ROLES
readonly
URI
/logging/active.json
/logging/active.ekjson
/logging/active.prettyjson
METHODS
GET

Start a log

DESC

Open a new log; if the same type of log is closed and opened multiple times in one session, it will have multipe log instances (such as Kismet-foo-2022-10-03-1.pcap, kismet-foo-2022-10-03-2.pcap )

After 2026-10-R1, an optional title, sent as POST JSON, names only the log being opened; the session title, and the other logs, are unchanged. The title is 1 to 64 characters of A-Z, a-z, 0-9, ., _, and -, not starting with .; any other title is refused, and no log is opened.

ROLES
URI
/logging/by-class/{LOGCLASS}/start.cmd
METHODS
GET POST
URI
PARAMETERS
LOGCLASS string REQUIRED

Log class / type to start

JSON
PARAMETERS

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

title string OPTIONAL

Title for this log’s file name, in place of the session title; after 2026-10-R1

RETURN
Success or failure of log opening.
RESPONSES
200
Success
ERROR
Request error, such as malformed log class or permissions error
NOTES
Some logs, like kismetdb, are only permitted a single logging instance.

Stopping a log

DESC
Stop and close a current log.
ROLES
URI
/logging/by-uuid/{UUID}/stop.cmd
METHODS
GET
URI
PARAMETERS
UUID string REQUIRED

Log UUID to stop

Start a new log file

DESC

After 2026-10-R1, closes the current file of a kismetdb or pcapng log and continues the log in a new file, the same as when the log reaches kis_log_max_mb / kis_log_max_seconds or pcapng_log_max_mb / pcapng_log_max_seconds. The new file starts shortly after the request returns, and no packets are lost.

The log template needs %i, so the new file gets the next sequence number.

When the old file is closed and complete, a LOG_FINISHED event is published on the eventbus with the reason api.

ROLES
URI
/logging/by-uuid/{UUID}/rotate.cmd
METHODS
POST
URI
PARAMETERS
UUID string REQUIRED

Log UUID to start a new file for

RETURN
OK when the new file has been requested.
RESPONSES
200
Success
500
Invalid UUID, no such log, a log type which can't start a new file, a log which isn't open, or a log template without `%i`
NOTES
Only kismetdb and pcapng logs can start a new file.