PROFESSIONALCOMMUNITY

Logger

  • Last updated: May 17, 2022

  • Read time: 3 Minutes

Logger is a tool for recording network activity. Logger records all HTTP traffic that Burp Suite generates, for investigation and analysis, but is particularly useful for:

  • Investigating what happened if Burp Suite is producing unexpected results.
  • Looking at the details of what Burp Suite is sending when your work involves session handling.
  • Making sure that long-term ongoing tasks (such as background scans) are still running.
  • Analysis of any issues that need visibility into what Burp Suite is doing.
Logger tool

Quick start guides

Logging and memory

Logger keeps records of HTTP network traffic up to its limit of allocated memory. Once the limit is reached, Logger discards the oldest entries as new entries are created. The default memory limit for Logger is 50MB, or 100MB if you give Burp Suite access to at least 1GB of memory. You can change the memory limit by clicking on the capture filter. Note that allocating a large amount of memory to logging can cause performance issues. We recommend that you start logging with the default amount of memory, and only increase it if you have problems that require significant numbers of entries.

Logger functionality

Logger entries are read-only (apart from you annotating items of interest: see below), but otherwise have the full functionality of the message editor available, including the Inspector. You can also send the contents of Logger entries to other tools, such as Repeater and Intruder.

Information on entries is displayed in several columns. Not every column will be relevant to each entry. You can adjust which columns are displayed by clicking on the Columns drop-down menu. Reorder and resize columns by clicking and dragging the column headers and column borders.

The leftmost column, marked by a #, counts the number of entries that have been logged in this session. If you are choosing not to capture all entries (see options) then the numbers may not be contiguous, as the count refers to the number of events that could have been captured, rather than events that were actually captured.

Delete all current entries by clicking on the Clear logs bin icon.

You can mark entries for later attention. Click on an entry at the # column to highlight that record in a different color. Double click on an entry at the Comment column to leave a comment on that entry.

Logger annotations

Export Logger entries as CSV

To export Logger entries as a CSV file, select the relevant entries in the table, right-click and select Export as CSV. Note that selecting zero entries or one entry will export the whole table.

When exporting entries in CSV format, Logger encodes certain data as follows:

  • Date times are represented in ISO 8601 format with UTC offset: yyyy-MM-dd'T'HH:mm:ss.SSS'Z'.
  • Binary data (e.g. HTTP/2 requests and responses) are represented as Base64 encoded strings.
  • Any data that contains a comma is escaped by wrapping the data in double quotes. e.g. a,b will become "a,b".
  • Any data containing double quotes is escaped by an additional double quote e.g. "a" will become """a""".
  • Any data starting with -, +, = or @ is escaped for Excel by prefixing a single quote (').

Task logger

Logger captures traffic from across Burp Suite. In addition, the task logger lets you examine traffic generated by single tasks. You can examine task log entries by doing the following:

  • From the Dashboard, click on the View details icon of the task.
  • Select the Logger tab in the task window.

The task logger has the same functionality as Burp Logger, but uses a different allocation of memory for each task. The default memory allocation for logging each task is 10MB, or 20MB if you give Burp Suite access to 1GB or more of memory. You can use the task logger to investigate a task that is behaving unexpectedly, or to monitor the progress of a task.

The task logger has the same capture and view options as Burp Logger, except that the Capture by tool and Filter by tool options are absent. This is because the task logger only captures and displays traffic from the tool used for the task.

Logger configuration

Logger provides separate controls to configure what it captures and what it displays. Details for Logger options can be found here.