3.8.6. Enable Management Interface Audit Logging to a Syslog Server


Add the prefix /host=HOST_NAME to the /core-service commands if the change is to be applied to a managed domain.
In this example the syslog server is running on the local host on port 514. Replace these parameters with values appropriate to your environment.

Procedure 3.24. Enable Logging to a Syslog Server

  1. Create a syslog handler named msyslog

    [standalone@localhost:9999 /]batch
    [standalone@localhost:9999 /]/core-service=management/access=audit/syslog-handler=mysyslog:add(formatter=json-formatter)
    [standalone@localhost:9999 /]/core-service=management/access=audit/syslog-handler=mysyslog/protocol=udp:add(host=localhost,port=514)
    [standalone@localhost:9999 /]run-batch
  2. Add a reference to the syslog handler.

    [standalone@localhost:9999 /]/core-service=management/access=audit/logger=audit-log/handler=mysyslog:add

Management interface audit log entries are logged on the syslog server.