[AuditSink_syslog]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [AuditSink_syslog] of settings/audit.ini.
File
settings/audit.ini; override it in settings/override/audit.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Transport | local | RFC 5424 with structured data, one message per record. local the system log: journald's native socket where the system runs journald (journalctl -t <AppName> finds the records; rsyslog reading the journal gets them too), else /dev/log; written at flush time journald journald's native socket only devlog /dev/log with the RFC 5424 line as is (journald 252 does not parse its header) udp Host:Port, header and structured data only (RFC 5426) tcp|tls Host:Port, the whole record, octet counting (RFC 6587, RFC 5425) udp, tcp and tls go through the spool and are sent by the cronjob part. |
| Host | (empty) | |
| Port | 514 | |
| Facility | authpriv | Facility: auth | authpriv | daemon | local0 … local7 |
| AppName | exponential | The APP-NAME, and the identifier in journald (journalctl -t exponential). |
| Events[] | (empty array) | Which events: patterns; empty = everything routed to this sink. |
| MinSeverity | info |
See also
Generated example: audit.ini [AuditSink_syslog]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/audit.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment