Application log files
- Fircosoft Continuity 5 & 6
- log4j
- Serilog
- syslog
- JSON
Continuity core, Java, FOF and orchestrator logs. A rule builder with a live test bench for anything proprietary.
StreamWatch
Every log, every platform, one place to look.
Lightweight agents read your logs where they are written — on Windows, Linux and AIX. They mask sensitive values before anything leaves the host and deliver to one server inside your perimeter. Search 30 days in milliseconds and see errors grouped by cause.
Log collection, investigation and alerting. Installed on-premises, one deployment per institution.
streamwatch.your-bank.internal
WICSStreamWatch
1AK
The StreamWatch search screen: a query runs across every application and server at once, results arrive from Windows, Linux and AIX hosts in milliseconds, levels in colour, sensitive values already masked.
Illustrative — invented names and figures.
The pattern today
Hours of access requests — or one search.
When a payment stalls or a job fails, the clock starts. Without StreamWatch, people ask for access, open server sessions and copy huge files. With it, the logs are already indexed and already masked.
Investigation in minutesOne search replaces a chain of access requests and manual file retrieval.
Production access withdrawnStaff who needed a server only to read a log no longer need one.
You find out firstFailures reach you from StreamWatch, not from a customer.
Illustrative — invented names and figures.
Complete collection
Every source that matters — including the ones nobody else covers.
Agents run on Windows, Linux and AIX — the platforms that carry core banking and screening workloads. They read files, events, web logs and database tables on the host that produces them.
Everything here sits inside your own perimeter
Masked, then HTTPS
Entitled by application
Windows
Linux
AIX
Databases
StreamWatch serverEmbedded index · 30 days searchable
Lines indexed today
61,240
Configuration
SQL Server or PostgreSQL
Archive
5 years · plain text
Investigators
On-call teams
Administrators
Windows Event Log
- Application
- System
- Security
- Custom channels
Filtered to what matters: critical events, errors, warnings and audit failures.
IIS and W3C web logs
- IIS
- W3C
Read with the field order each server actually declares.
Database log tables
- SQL Server
- Oracle
- PostgreSQL
- MySQL
Operational and application log tables, polled directly.
The awkward cases, handled
- Rotation
- Truncation
- Multi-line records
- Mixed encodings
- BOM markers
Stack traces arrive whole, and nothing is silently missed at midnight.
Illustrative — invented names and figures.
Investigation in seconds
Built for the person under pressure.
Search every application and server at once, filtered by level, application, source, host and time. Results return in milliseconds.
Watch a log as it is written.
Live tail shows the output as it lands — without a server session, an account or a password.
- Follow the applications your team is entitled to
- Multi-line records such as stack traces arrive whole
- Values are already masked when they reach your screen
Live tailpayments-gateway · win-pay-03Live
- No server session
- No account
- No password
Twelve thousand lines. Five causes.
Errors are grouped by cause, each with its frequency and its first and last occurrence. Open one to see the lines around it and every event that shares its trace.
- Lines before and after the error, on demand
- Every event that shares the same trace
- Export to CSV for the incident record, the vendor ticket or the post-mortem
streamwatch.your-bank.internal/errors
WICSStreamWatch
AK
The errors screen: twelve thousand raw lines collapse into five causes, each with its count and its first and last occurrence. The selected cause shows the lines before and after it and the events that share its trace.
Errors
All applications · today
Export CSV
12,000lines5causes
Illustrative — invented names and figures.
Data protection by design
Masked on the host, before a single byte moves.
Masking runs inside the agent, on the server that wrote the line. Sensitive values never cross your network and are never written to the search index.
- Built-in rules for card numbers, secrets and credentials, IBANs, e-mail addresses, licence holders and the personal data inside screening payloads
- Screening output uses an allow-list: useful labels survive; names, addresses, identity numbers and dates of birth do not
- Fail-safe: if a rule cannot be evaluated, the whole field is redacted
- Your own rules — national identifiers, account formats, internal references — added without a code change
A log file is a copy of your customer data.
It is rarely treated as one. StreamWatch treats it that way from the first line: the unmasked value never exists anywhere else — not on the network, not in the index, not on an engineer’s laptop.
Illustrative — invented names and figures.
Alerting
One fault, one incident. Not a thousand messages.
Threshold rules per application and severity, grouped by error signature. The responsible team is told the moment a threshold is crossed — before your customers notice.
Thresholds per application and severity
Grouped by error signature, so one recurring fault raises one incident.
Silence detection
A rule fires when an agent stops reporting or a source falls quiet — failures that usually go unnoticed for days.
Quiet periods, mute and resolution messages
So on-call teams keep trusting the channel.
Incident notes
The investigation and its conclusion stay with the alert that raised it.
Illustrative — invented names and figures.
Access, evidence and retention
Each team sees its own applications. Every change is recorded.
Sign in with Active Directory and your existing groups. Access to log data is scoped by application and enforced by the server — not by a hidden menu.
Active Directory sign-in
Your existing groups, mapped to roles.
Per-application entitlement
A team sees its own applications — enforced by the server, not by a hidden menu.
Every configuration change recorded
Sources, parsers, masking rules, alert rules and channels — with the person and the time.
Illustrative — invented names and figures.
Retention that satisfies both audiences
30 daysSearchable
At full speed, for investigation and day-to-day support.
5 yearsArchived
Compressed, open plain text — readable with standard tools, with no proprietary format to depend on.
Architecture
Two components. Nothing else to run.
A central server and lightweight agents. No message broker, no search cluster and no third-party analytics stack to licence, patch or staff.
The server
Installed once per institution on Windows Server or Linux, on-premises or in your private cloud. Log data never leaves your infrastructure.
- Embedded search engine
- Configuration database: SQL Server or PostgreSQL
- Windows authentication supported
- Embedded database for evaluation
The agents
A Windows service, a systemd unit or an AIX subsystem. The Windows and Linux packages carry their own Java runtime — no platform-wide runtime upgrade.
- Individually issued keys over HTTPS
- Buffer to local disk, 1 GB by default
- Delivery in order, duplicates suppressed
- Within a 64 MB heap
Not needed
- Message broker
- Search cluster
- Analytics stack
Store-and-forward deliveryWhen the server or network is away, each agent buffers to local disk, then delivers in order. A maintenance window costs you no data.
Enterprise service integrationGroup Managed Service Accounts, Windows certificate-store trust for internal CAs, outbound proxy support and least-privilege permissions applied by the installer.
Standards-based integrationHTTPS throughout, LDAPS to Active Directory, SMTP for mail, Microsoft Teams Workflows and generic JSON webhooks for ITSM and on-call tools.
- Log lines in under one minute
- 100,000
- Ingested, masked, indexed and searchable
- Typical search response
- 8–150 ms
- Across every application and host
- Of one CPU core
- < 1%
- Per agent, at rest
- Peak agent working set
- 145 MB
- During bulk import
Measured in our reference deployment, where 100,000 lines is a full institutional day. Agents run within a 64 MB heap.
Putting it in place
A controlled, repeatable installation.
One command for the server, one per host for each agent. Full installation and user manuals come with every release.
- 1
Install the server
A single elevated command: configuration, certificate, firewall rule, service and health check included.
- 2
Install an agent
One command per host — Windows, Linux or AIX.
- 3
Point it at your logs
Ready-made formats for the common ones; a rule builder with a live test bench for anything proprietary.
- 4
See it on your own logs
In one working session, our team connects an agent to one of your applications and shows collection, masking, search and alerting on your data.
Validated against real log estates, not samples.
Every file in our reference set of more than 500 production screening logs parses without a single unrecognised record. Each release passes an automated suite covering rotation, restart, encoding, masking and end-to-end delivery.
On the roadmap
- OpenTelemetry ingest
- Maintenance windows and deployment markers
- Archive re-import
- Container images
- WhatsApp alerts
Everything else on this page is in the product today.
What we are asked first
No. The server is installed inside your own perimeter, and masking runs on the host that wrote the line. Nothing is sent to us.
See StreamWatch on your own logs.
One working session, one of your applications, on Windows, Linux or AIX.