Send audit log data to a remote syslog server

The audit log collects data about ExtraHop system operations, broken down by component. The log stored on the system has a capacity of 10,000 entries, and entries older than 90 days are automatically removed. You can view these entries in the Administration settings, or you can send the audit log events to a syslog server for long-term storage, monitoring, and advanced analysis. All logged events are listed in the table below.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Status and Diagnostics section, click Audit Log.
3. Click Configure Syslog Settings.
4. In the Destination field, type the IP address of the remote syslog server.
5. From the Protocol drop-down list, select one of the following options:
   • TCP
   • TLS
   • UDP
   This option specifies the protocol over which the information is sent to your remote syslog server.

   Note:

   If you select TLS, the ExtraHop system must verify the syslog server identity by validating the TLS certificate of the server. You can configure the ExtraHop system to trust the certificate authority (CA) that signed the certificate of the syslog server in the Administration settings.

6. In the Port field, type the port number for your remote syslog server.
   The default value is 514.
7. Click Test Settings to verify that your syslog settings are correct.
   If the settings are correct, you should see an entry in the syslog log file on the syslog server similar to the following:

   Jul 27 21:54:56 extrahop name="ExtraHop Test" event_id=1

   Copy
8. Click Save.
9. (Optional): Modify the format of syslog messages:
   By default, syslog messages are not compliant with RFC 3164 or RFC 5424. However, you can format syslog messages to be compliant by modifying the running config.
   1. Click Admin.
   2. Click Running Config (Unsaved Changes).
   3. Click Edit Config.
   4. Add an entry under auditlog_rsyslog where the key is rfc_compliant_format and the value is either rfc5424 or rfc3164.
      The auditlog_rsyslog section should look similar to the following code:

          "auditlog_rsyslog": {
              "syslog_destination": "192.168.0.0",
              "syslog_ipproto": "udp",
              "syslog_port": 514,
              "rfc_compliant_format": "rfc5424"
          }

      Copy
   5. Click Update.
   6. Click Done.
10. (Optional): Modify the timezone referenced in syslog timestamps:
    By default, syslog timestamps reference UTC time. However, you can modify timestamps to reference the ExtraHop system time by modifying the running config.
    1. Click Admin.
    2. Click Running Config (Unsaved Changes).
    3. Click Edit Config.
    4. Add an entry under auditlog_rsyslog, where the key is syslog_use_localtime and the value is true.
       The auditlog_rsyslog section should look similar to the following code:

           "auditlog_rsyslog": {
               "syslog_destination": "192.168.0.0",
               "syslog_ipproto": "udp",
               "syslog_port": 514,
               "syslog_use_localtime": true
           }

       Copy
    5. Click Update.
    6. Click Done.