Hi all,
Can I check how do you pipe audit trail logs from Ignition to external syslog server ?
Is there a place where all audit trail logs be consolidated on Ignition platform ?
Audit trails logs that I’m referring to are login/logout of users, modification of user roles, etc
If you created an audit profile that depends on an external database the audit logs are already consolidated in the database in the table name defined in Gateway config > Security/Auditing settings.
Depending on what database you’re using the methods available to you to get that audit data from there to your syslog server might vary, but knowing where the audit logs are consolidated and in what format they are in might be enough for you to go off.
As @jthorpe mentions, we have our audit profiles that allow storing of audit events to a database table. It does bring to mind the idea of adding a checkbox to existing Audit Profile configurations to have events logged to the Ignition log system (or perhaps a logging-only audit profile as well, no DB at all). This way you could use logback functionality (such as the SyslogAppender) or even the java service wrapper syslog forwarding to ship those (and/or other) logs onto your syslog server…
I linked this request to ticket IGN-6036. Go to the ideas link below if you'd like to "upvote" the ticket.