Audit Log Output to a Centralized Logging Solution

Keyfactor Command can forward audit log events in real time to an external syslog server for centralized collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be available in other places in the Management Portal (for example expiration alerts and certain reports). and analysis (for example, rsyslog Rsyslog is an open-source software utility used on UNIX and Unix-like computer systems for forwarding log messages in an IP network., Splunk, Elastic Stack, or Grafana Loki/Grafana). Only audit events are shipped using this feature.

Audit events forwarded to an external syslog server are generated by the auditing subsystem and are not controlled by NLog configuration. Changing logging levels or targets in nlog.config does not alter the audit events that are delivered.

Audit events can be delivered to:

• An rsyslog daemon on a Linux server for consolidation and forwarding

• A centralized logging pipeline (for example, Splunk or Logstash)

• Any backend solution that accepts syslog over TCP

Delivery over TLS TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols for establishing authenticated and encrypted links between networked computers. is supported for receivers that are configured to accept TLS syslog connections.

Configuration of a centralized logging solution itself is outside the scope of this guide. A sample rsyslog configuration demonstrating TLS setup is provided in Prepare for External Log Shipping over TLS (Optional).

Configuration Settings

Log output settings are configured on the Auditing tab of the Application Settings page.

• Host Name

  Specify the fully qualified domain name of the server that will receive the audit events.

• Port

  Specify the TCP port on which the syslog receiver is listening.

  The specified port must correspond to an active TCP listener on the receiving system.TLS-enabled syslog is commonly configured on TCP port 6514, though any port may be used if both systems are configured consistently.

  The default is 514.

• Use SysLog Server

  Set to True to turn on forwarding of audit events to an external syslog server.
  The default is False.

• Use TLS Connection

  Set to True to send audit events over a TLS-encrypted TCP connection. The receiving syslog server must be configured to support TLS on the specified port.
  The default is False.

When you click Save, Keyfactor Command attempts to verify that a TCP connection can be established to the specified host and port.