i am working on a forensic project which aims to judge/evaluate forensic artifacts on a device. As device i’ve set up webthings with yeelight smart lights. I now try to understand the logs better. I’ve set up one log for brightness and one log for on/off information in den WebGUI. I do find the logs in:
- .webthings/log/ as text
- .webtings/log/ as sqlite3 db
If i understand well, the run-app.log files contain information about tunnel services, addon management, certificates, errors and more. But I do not see any information on turning the device on/off or changing properties (unless the device is turned off and an error is returned). I do seem to find this information in the sqlite3 tables (metricsBool, metricsNumber).
Now is there a way to log the change properties to the run-app.log files? Or are they stored somewhere else and i just didnt find them?