audit.ini [AuditSink_syslog] #

The block [AuditSink_syslog] of settings/audit.ini, with 7 setting(s).

Never edit settings/audit.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/audit.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/audit.ini.append.php for one siteaccess,
• extension/<extension>/settings/audit.ini.append.php in an extension (read when the extension is active).

Transport #

RFC 5424 with structured data, one message per record.
local the system log: journald's native socket where the system runs journald
(journalctl -t <AppName> finds the records; rsyslog reading the journal
gets them too), else /dev/log; written at flush time
journald journald's native socket only
devlog /dev/log with the RFC 5424 line as is (journald 252 does not parse its header)
udp Host:Port, header and structured data only (RFC 5426)
tcp|tls Host:Port, the whole record, octet counting (RFC 6587, RFC 5425)
udp, tcp and tls go through the spool and are sent by the cronjob part.

Default: local.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
Transport=local
*/ ?>

Host #

Default: empty.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
Host=
*/ ?>

Port #

Default: 514.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
Port=514
*/ ?>

Facility #

Facility: auth | authpriv | daemon | local0 … local7

Default: authpriv.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
Facility=authpriv
*/ ?>

AppName #

The APP-NAME, and the identifier in journald (journalctl -t exponential).

Default: exponential.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
AppName=exponential
*/ ?>

Events #

Which events: patterns; empty = everything routed to this sink.

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
# an empty "Events[]" first replaces the shipped list; without it the items are added
Events[]
*/ ?>

MinSeverity #

Default: info.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSink_syslog]
MinSeverity=info
*/ ?>

Related #

• All blocks of audit.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/audit.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.