Syslog JSON Audit Log Publisher

The Syslog JSON Audit Log Publisher can be used to write JSON-formatted audit log messages to a syslog server.

Parent Component Relations from This Component Properties dsconfig Usage

Parent Component

The Syslog JSON Audit Log Publisher component inherits from the JSON Formatted Audit Log Publisher

Relations from This Component

The following components have a direct aggregation relation from Syslog JSON Audit Log Publishers:

Properties

The properties supported by this managed object are as follows:


General Configuration Basic Properties: Advanced Properties:
 description  None
 enabled
 logging-error-behavior
Log File Management Basic Properties: Advanced Properties:
 write-multi-line-messages  None
Syslog Configuration Basic Properties: Advanced Properties:
 syslog-external-server  queue-size
 syslog-facility
 syslog-severity
 syslog-message-host-name
 syslog-message-application-name
Log Messages To Include Basic Properties: Advanced Properties:
 log-security-negotiation  None
 suppress-internal-operations
 suppress-replication-operations
Filtering Criteria Basic Properties: Advanced Properties:
 connection-criteria  None
 request-criteria
 result-criteria
Log Message Elements To Include Basic Properties: Advanced Properties:
 use-reversible-form  soft-delete-entry-audit-behavior
 obscure-attribute  include-operation-purpose-request-control
 exclude-attribute  include-intermediate-client-request-control
 include-product-name  include-thread-id
 include-instance-name
 include-startup-id
 include-requester-dn
 include-requester-ip-address
 include-request-controls
 include-response-controls
 include-replication-change-id

Basic Properties

description

Property Group
General Configuration
Description
A description for this Log Publisher
Default Value
None
Allowed Values
A string
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

enabled

Property Group
General Configuration
Description
Indicates whether the Log Publisher is enabled for use.
Default Value
None
Allowed Values
true
false
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action

logging-error-behavior

Property Group
General Configuration
Description
Specifies the behavior that the server should exhibit if an error occurs during logging processing.
Default Value
standard-error
Allowed Values
standard-error - Write a message to standard error in the event of a logging failure.

lockdown-mode - Place the server in lockdown mode in the event of a logging failure.
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

write-multi-line-messages

Property Group
Log File Management
Description
Indicates whether the JSON objects should use a multi-line representation (with each object field and array value on its own line) that may be easier for administrators to read, but each message will be larger (because of additional spaces and end-of-line markers), and it may be more difficult to consume and parse through some text-oriented tools.
Default Value
false
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

syslog-external-server

Property Group
Syslog Configuration
Description
The syslog server to which messages should be sent. Multiple servers can be configured for the sake of redundancy. If multiple servers are configured, then they must all be configured to communicate over TCP (with or without TLS encryption). When sending a syslog message, servers will be tried in the order in which they are listed.
Default Value
None
Allowed Values
The DN of any Syslog External Server.
Multi-Valued
Yes
Required
Yes
Admin Action Required
None. Modification requires no further action

syslog-facility

Property Group
Syslog Configuration
Description
The syslog facility to use for the messages that are logged by this Syslog JSON Audit Log Publisher.
Default Value
system-daemons
Allowed Values
user-level-messages - A facility that is commonly used for messages logged by user applications running on the system. This facility has an integer value of 1.

system-daemons - A facility that is commonly used for messages logged by daemon processes running on the system. This facility has an integer value of 3.

security-and-authorization - A facility that is commonly used for messages related to security and authorization-related processing. This facility has an integer value of 4.

security-and-authorization-alternative - An alternative facility for messages related to security and authorization-related processing. This facility has an integer value of 10.

log-audit - A facility for messages related to log audit processing. This facility has an integer value of 13.

log-alert - A facility for messages related to log alert processing. This facility has an integer value of 14.

local-use-0 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 16.

local-use-1 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 17.

local-use-2 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 18.

local-use-3 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 19.

local-use-4 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 20.

local-use-5 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 21.

local-use-6 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 22.

local-use-7 - A facility that does not have any predefined purpose and may be used for any arbitrary purpose. This facility has an integer value of 23.
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action

syslog-severity

Property Group
Syslog Configuration
Description
The syslog severity to use for the messages that are logged by this Syslog JSON Audit Log Publisher.
Default Value
informational
Allowed Values
emergency - A severity that is commonly used for messages indicating that the system is unusable. This severity has an integer value of 0.

alert - A severity that is commonly used for messages that require immediate administrative action. This severity has an integer value of 1.

critical - A severity that is commonly used for messages that represent critical error conditions. This severity has an integer value of 2.

error - A severity that is commonly used for messages that represent non-critical error conditions. This severity has an integer value of 3.

warning - A severity that is commonly used for messages that represent warning conditions. This severity has an integer value of 4.

notice - A severity that is commonly used for messages that represent normal but significant conditions. This severity has an integer value of 5.

informational - A severity that is commonly used for informational messages. This severity has an integer value of 6.

debug - A severity that is commonly used for debug messages. This severity has an integer value of 7.
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action

syslog-message-host-name

Property Group
Syslog Configuration
Description
The local host name that will be included in syslog messages that are logged by this Syslog JSON Audit Log Publisher. If this is specified, then the value must be between 1 and 255 characters in length, and it must contain only printable ASCII characters between 0x21 (the '!' character) and 0x7E (the '~') character, inclusive. It should represent a qualified or unqualified hostname, an IPv4 address, or an IPv6 address.

If this is not specified, then the server will attempt to automatically determine the hostname for the local system.

If no hostname should be included in syslog messages, then a value of "-" should be used.

Default Value
The server will attempt to automatically determine the hostname for the local system.
Allowed Values
A string
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

syslog-message-application-name

Property Group
Syslog Configuration
Description
The application name that will be included in syslog messages that are logged by this Syslog JSON Audit Log Publisher. If this is specified, then the value must be between 1 and 48 characters in length, and it must contain only printable ASCII characters between 0x21 (the '!' character) and 0x7E (the '~') character, inclusive.

If this is not specified, then the server will use a default value of "PingDirectory".

If no application name should be included in syslog messages, then a value of "-" should be used.

Default Value
The server will use a default value of "PingDirectory".
Allowed Values
A string
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

log-security-negotiation

Property Group
Log Messages To Include
Description
Indicates whether to log information about the result of any security negotiation (e.g., SSL handshake) processing that has been performed.
Default Value
false
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

suppress-internal-operations

Property Group
Log Messages To Include
Description
Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users.
Default Value
false
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

suppress-replication-operations

Property Group
Log Messages To Include
Description
Indicates whether access messages that are generated by replication operations should be suppressed.
Default Value
false
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

connection-criteria

Property Group
Filtering Criteria
Description
Specifies a set of connection criteria that must match the associated client connection in order for a connect, disconnect, request, or result message to be logged.
Default Value
None
Allowed Values
The DN of any Connection Criteria.
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

request-criteria

Property Group
Filtering Criteria
Description
Specifies a set of request criteria that must match the associated operation request in order for a request or result to be logged by this Access Log Publisher.
Default Value
None
Allowed Values
The DN of any Request Criteria.
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

result-criteria

Property Group
Filtering Criteria
Description
Specifies a set of result criteria that must match the associated operation result in order for that result to be logged by this Access Log Publisher.
Default Value
None
Allowed Values
The DN of any Result Criteria.
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

use-reversible-form

Property Group
Log Message Elements To Include
Description
Indicates whether the audit log should be written in reversible form so that it is possible to revert the changes if desired. If this property is set true then the audit log is written in reversible form. For delete operations there will be comments with the contents of the entry. For modify operations the changes will only contain delete of the previous values and add of the new values (omitting those that didn't change). For modify DN operations there will be comments with the attribute additions or deletions, if any, caused by the RDN change.
Default Value
false
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

obscure-attribute

Property Group
Log Message Elements To Include
Description
Specifies the names of any attribute types that should have their values obscured in the audit log because they may be considered sensitive. Note that values are not obscured from any DN.
Default Value
None
Allowed Values
The name or OID of an attribute type defined in the server schema.
Multi-Valued
Yes
Required
No
Admin Action Required
None. Modification requires no further action

exclude-attribute

Property Group
Log Message Elements To Include
Description
Specifies the names of any attribute types that should be excluded from the audit log.
Default Value
ds-sync-hist
Allowed Values
The name or OID of an attribute type defined in the server schema.
Multi-Valued
Yes
Required
No
Admin Action Required
None. Modification requires no further action

include-product-name

Property Group
Log Message Elements To Include
Description
Indicates whether log messages should include the product name for the Directory Server.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-instance-name

Property Group
Log Message Elements To Include
Description
Indicates whether log messages should include the instance name for the Directory Server.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-startup-id

Property Group
Log Message Elements To Include
Description
Indicates whether log messages should include the startup ID for the Directory Server, which is a value assigned to the server instance at startup and may be used to identify when the server has been restarted.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-requester-dn

Property Group
Log Message Elements To Include
Description
Indicates whether log messages for operation requests should include the DN of the authenticated user for the client connection on which the operation was requested.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-requester-ip-address

Property Group
Log Message Elements To Include
Description
Indicates whether log messages for operation requests should include the IP address of the client that requested the operation.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-request-controls

Property Group
Log Message Elements To Include
Description
Indicates whether log messages for operation requests should include a list of the OIDs of any controls included in the request.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-response-controls

Property Group
Log Message Elements To Include
Description
Indicates whether log messages for operation results should include a list of the OIDs of any controls included in the result.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-replication-change-id

Property Group
Log Message Elements To Include
Description
Indicates whether to log information about the replication change ID. The replication change ID uniquely identifies an update operation. When enabled on all replicas in the replication topology, it can be used to trace updates from the origin replica to all other replicas.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action


Advanced Properties

queue-size (Advanced Property)

Property Group
Syslog Configuration
Description
The maximum number of log records that can be stored in the asynchronous queue. The server will continuously flush messages from the queue to the log. That is, it does not wait for the queue to fill up before flushing to the log. Lowering this value can impact performance.
Default Value
100000
Allowed Values
An integer value. Lower limit is 1000. Upper limit is 100000 .
Multi-Valued
No
Required
No
Admin Action Required
The Syslog JSON Audit Log Publisher must be restarted if this property is changed and the asynchronous property is set to true.

soft-delete-entry-audit-behavior (Advanced Property)

Property Group
Log Message Elements To Include
Description
Specifies the audit behavior for delete and modify operations on soft-deleted entries. This property pertains only to delete and modify operations on existing soft-deleted entries. Logging of soft delete operations and undelete operations are not affected by this property. Soft delete operations are logged like delete operations but with additional information in comments about the soft-deleted entry that was created. Undelete operations are logged like add operations but with additional information in comments about the soft-deleted entry that was undeleted.
Default Value
included
Allowed Values
included - Indicates that delete and modify operations of soft-deleted entries should be included in the log. The deletes of soft-deleted entries will include an "isSoftDeletedEntry" field with a Boolean value of true.

excluded - Indicates that delete and modify operations of soft-deleted entries should be excluded from the log.
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-operation-purpose-request-control (Advanced Property)

Property Group
Log Message Elements To Include
Description
Indicates whether to include information about any operation purpose request control that may have been included in the request.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-intermediate-client-request-control (Advanced Property)

Property Group
Log Message Elements To Include
Description
Indicates whether to include information about any intermediate client request control that may have been included in the request.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

include-thread-id (Advanced Property)

Property Group
Log Message Elements To Include
Description
Indicates whether log messages should include the thread ID for the Directory Server in each log message. This ID can be used to correlate log messages from the same thread within a single log as well as generated by the same thread across different types of log files. More information about the thread with a specific ID can be obtained using the cn=JVM Stack Trace,cn=monitor entry.
Default Value
true
Allowed Values
true
false
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action


dsconfig Usage

To list the configured Log Publishers:

dsconfig list-log-publishers
     [--property {propertyName}] ...

To view the configuration for an existing Log Publisher:

dsconfig get-log-publisher-prop
     --publisher-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Log Publisher:

dsconfig set-log-publisher-prop
     --publisher-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new Syslog JSON Audit Log Publisher:

dsconfig create-log-publisher
     --publisher-name {name}
     --type {type}
     --set enabled:{propertyValue}
     --set syslog-external-server:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Log Publisher:

dsconfig delete-log-publisher
     --publisher-name {name}