Syslogs

Audit records are logged to a local database and a Loki Grafana microservice by default. This is suitable for production systems and clusters with a limited load. However, for clusters that support a large number of transactions, it is recommended to configure the CipherTrust Manager to disable logging to a local database and enable logging using remote Syslog server(s). This significantly reduces the cluster traffic and disk usage.

Timezone Configuration

CipherTrust Manager server audit records and client audit records are always recorded in UTC time zone, in keeping with RFC 3339. This is important to note when you configure any external logging system such as a log forwarder or legacy syslog connection.

Add a new Syslog Server

The preferred Syslog configuration is through Connection Manager and Log Forwarders commands and menus. The syslog configuration is specific to the domain it is created in.

Add a Syslog Connection with Connection Manager

The preferred Syslog configuration is through Connection Manager. Provide the following values:

• Host: IP address or hostname of the Syslog server.

• Port: port number for connecting to the Syslog server.

• Transport Format: select the transport mode for sending data. The TLS mode requires a trusted CA certificate in the PEM format.

  Note

  If you set the transport format to UDP, log messages are limited to a size of 1024 bytes. After this size, the log message is truncated.

• CA Cert: either upload the CA certificate or paste the certificate content. Make sure the server certificate contains the valid IP SANs.

• Upload CSR: select and click Upload CSR to upload the trusted CA certificate from your machine.

• Text: select and paste the certificate content in the text field.

• Message Format: select the log message format.

Add a Syslog Log Forwarder

Once you have added a syslog connection, you can create a syslog log forwarder on CipherTrust Manager to forward KMIP activity logs, NAE activity logs, server audit records, and client audit records to Syslog server.

To add a Syslog log forwarder, you must provide:

• a connection ID of the Syslog connection manager (refer to Connection Manager for details)

• a connection name for the log forwarder configuration

You can optionally activate/deactivate:

• forward logs for activity kmip

• forward logs for activity nae

• forward logs for client audit records

• forward logs for server audit records

Syntax for Syslog

ksctl log-forwarders add syslog --name <name of log forwarder> --connection-id <Syslog ConnectionID/Name> --forward-client-audit-records <true/false> --forward-logs-activity-kmip <true/false> --forward-logs-activity-nae <true/false> --forward-server-audit-records <true/false>]

Modifying Legacy Connection to a Syslog Server

Updating a syslog server connection managed through Connection Manager is described on the Connection Manager page. The following instructions describe how to update legacy syslog server connections managed through admin settings. The table below indicates editable parameters.

To modify the connection to a legacy Syslog server:

1. Log on to the CipherTrust Manager console as administrator.

2. Click Admin Settings to open the application.

3. Click Notifications > Syslog. The Syslog Settings section is displayed on the right. This section displays the configured connections to Syslog servers.

4. Click the ellipsis icon corresponding to the desired connection and click Edit.

   Note

   To delete a connection, click Delete.

5. Modify the fields as required.

6. Save the changes.

Managing Syslog Messages Redirection to Parent Domain using ksctl

Syslog messages redirection allows you to send the legacy syslog messages of the current domain to the syslog server configured in its parent domain. If the current domain is receiving the syslog messages from its child domain, those syslog messages will also be sent to the syslog server configured in the parent domain of the current domain.