Audit logs can feed bot file and syslog?

ℹ️ Support
1

Hi,
I Install version 24.0.3.2 and I have admin and nextcloud log. I wonder how can I feed both file and syslog at the same time? Because I will send audit log to SIEM but I want to keep in server at the same time

'log_type' => 'file'
'logfile' => '/data/nextcloud.log'
'log_type' => 'syslog'
'syslog_tag' => 'Nextcloud',
  'log.condition' => 
  array (
    'apps' => 
    array (
      0 => 'admin_audit',
    ),
  ),
);

can be used?
I try to use rsyslog to forward audit.log to remote syslog server but I get permission denied message. Even I set chmod 777 audit.log, nothing change. Anybody can achieve this?
Regards,

1 Like
2

I solved.
When I set a severity and send syslog with this severity audit log forwards successfully.
local7.info X.X.X.X:514

3

I have been trying to send it but it doesn’t work, it gives me a permissions error if the audit.log file is not in /var/log, would you help me?