AUDISP-SYSLOG(8)

✨ audisp-syslog ✨

okay bestie, welcome to the audisp-syslog manual page — it lives in the System Administration Utilities corner of your system, and it's lowkey iconic 💅

🌸 NAME 🌸

audisp-syslog — the plugin that pushes your audit events straight into syslog 🫶

🦋 SYNOPSIS 🦋

audisp-syslog [ OPTIONS ]

✨ DESCRIPTION ✨

So, audisp-syslog is a plugin for the audit event dispatcher, and what it does is wrap audit events right back around into syslog. no cap, that's the whole vibe 🎀

You can hand it three options, and here's the lineup:

• one is the syslog facility 🌈
• one is the syslog level that all events get logged with
• and one that decides whether events should be interpreted

The valid facilities are: LOG_LOCAL0 through 7, LOG_AUTH, LOG_AUTHPRIV, LOG_DAEMON, LOG_SYSLOG, and LOG_USER. periodt 💅

The valid levels are: LOG_DEBUG through LOG_EMERG. 👑

And where do you set all these? In the /etc/audit/syslog.conf file, on the args line. that's the spot 🍓

If you want your events to be interpreted, just add the word interpret to the args line. That makes all events get interpreted. Sounds cute, right? 🙈 but here's the catch: the drawback to this approach is that naive parsers can be tricked by an adversary who has the ability to name files, processes, or other user-controlled objects. so like, be aware bestie, that's a real one 😭

ngl, if you're aggregating multiple machines, you should edit auditd.conf to set the name_format to something meaningful and the log_format to enriched. That way you can actually tell where the event came from, and you'll have the user name and groups resolved locally before it gets sent off of the machine. main character energy for your logs fr fr 🌟

🎀 FILES 🎀

• /etc/audit/plugins/syslog.conf
• /etc/audit/auditd.conf

💖 SEE ALSO 💖

• auditd.conf(8)
• auditd-plugins(5)
• syslog(3)

🌈 AUTHOR 🌈

Steve Grubb ✨

so yeah, that's the whole page, bestie — written by Red Hat, dated August 2018, and it's AUDISP-SYSLOG(8) if you ever need to look it up again. slay, go forth and syslog responsibly 🫶💖