3.8.6. Enable Management Interface Audit Logging to a Syslog Server
Note
Add the prefix
/host=HOST_NAME
to the /core-service
commands if the change is to be applied to a managed domain.
In this example the syslog server is running on the local host on port 514. Replace these parameters with values appropriate to your environment.
Procedure 3.24. Enable Logging to a Syslog Server
Create a syslog handler named
msyslog
[standalone@localhost:9999 /]batch [standalone@localhost:9999 /]/core-service=management/access=audit/syslog-handler=mysyslog:add(formatter=json-formatter) [standalone@localhost:9999 /]/core-service=management/access=audit/syslog-handler=mysyslog/protocol=udp:add(host=localhost,port=514) [standalone@localhost:9999 /]run-batch
Add a reference to the syslog handler.
[standalone@localhost:9999 /]/core-service=management/access=audit/logger=audit-log/handler=mysyslog:add
Result
Management interface audit log entries are logged on the syslog server.