Syslog Export
ExaVault Premium can send Activity records to a remote Syslog collector for ingestion by a security information and event management (SIEM) system or another logging platform. The stream contains user, administrator, authentication, and file Activity. It does not include the appliance service logs stored under /data/exavault/logs/.
Configure Syslog
Open the Appliance Manager at https://<your-appliance-hostname>:9002/, then open the Configuration page. Enter the collector's address in Syslog Host and its listening port in Syslog Port. Save the configuration and restart the appliance from the Appliance Manager Home page.
ExaVault sends Syslog over UDP by default. When Syslog Port is 601, ExaVault uses TCP instead. The connection is not protected with TLS, so keep the traffic on a trusted network or protect it with your network infrastructure. Configure the collector and any intervening firewall for the same transport and port.
Messages use the Syslog FTP facility.
Activity Record Format
Each Activity record has this general shape:
[timestamp] <connection> <remote_ip> [(country)] <target> <action> <details> STATUS <result>timestamp
Appliance local time in %d/%b/%Y:%H:%M:%S format
connection
Connection type, such as Web (HTTPS), FTP, FTPS, SFTP, WebDAV, or API (HTTPS)
remote_ip
Source IP address for the activity
country
Two-letter country code when GeoIP lookup succeeds
target
Object type, such as PATH, USER, GROUP, SITE, BRAND, LINK, CONNECTOR, LOG, SHARE, or RULE
action
Action such as LOGIN, LOGOUT, WRITE, READ, REMOVE, CREATE, EDIT, MOVE, COPY, RESTORE, or MOVETOTRASH
details
Target-specific path, object, and acting-user information
result
200 OK, 400 WARNING, or 500 ERROR
Path activity uses the following detail forms:
Move and copy activity includes both locations:
The site root is removed from logged paths, spaces are represented with +, and an empty path is represented with -. User, group, site, brand, and Link records identify the modified object and the acting user when that information applies.
Example records:
Troubleshoot Missing Records
First confirm that the event appears in the web interface's Activity records. If it does not, investigate the underlying action before troubleshooting Syslog delivery.
When the Activity record exists but does not reach the collector, confirm that the site has the Premium feature, the host and port are correct, the collector is listening with the expected UDP or TCP transport, and the network permits traffic from the appliance. Review the celery files described in Logging for forwarding errors, using the event time to correlate the records.
Last updated