yara-scan-logs
Lists recorded per-file YARA scan results for a period, one row per file. Only detected files and error results are recorded; files without detections or errors appear only in the report totals.
yara-scan-logs [from=VALUE] [to=VALUE] [duration=VALUE]
- from=VALUE
- Optional. Start time as yyyyMMddHHmmss. Shorter forms such as yyyyMMdd are accepted.
- to=VALUE
- Optional. End time as yyyyMMddHHmmss. Shorter forms such as yyyyMMdd are accepted. The specified second is included.
- duration=VALUE
- Optional. Positive period length: s (seconds), m (minutes), h (hours), d (days), or w (weeks). A number without a unit means seconds. Default: 1d.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Scanned at | e.g. 2026-09-12 23:34:22 |
| scan_guid | String | Scan GUID | e.g. 0545f99b-6bfd-4f4f-9be7-1e6d4a3b9c1a - matches guid in yara-scan-reports |
| file_name | String | File name | e.g. sample.exe |
| file_url | String | File url | e.g. sonar://samples/malware/sample.exe |
| file_size | Long | File size | Bytes |
| is_matched | Boolean | Matched | e.g. true - false means the row is an error, not a detection |
| match_count | Integer | Match count | e.g. 2 |
| rules | String | Matched rules | e.g. EICAR_Test_File,SUSP_Just_EICAR |
| error | String | Error | e.g. read failed: access denied - empty for a detection |
| source | String | Source | e.g. archived - live while the scan is still in the database |