| Time | Device | Client | Query | Disposition | Cache | ms |
|---|
Recent security events
Auth, device pairing/approval/revocation, and your Lighthouse/GNC fleet's own operational events (service start, DNS-capture apply/revert, sync failures) — separate from the DNS query log above. Latest 200; also forwarded live to your SIEM destination.
| When | Component | Category | Severity | Actor | Message |
|---|
Log retention
How long query logs are kept before being automatically deleted.
days