Management API Reference for syslog-audit-log

An audit logger that sends audit events to a remote syslog server.

Provided Capabilities (1)

Name	Dynamic	Other provider points
org.wildfly.security.security-event-listener	true	/subsystem=elytron/periodic-rotating-file-audit-log=* /subsystem=elytron/aggregate-security-event-listener=* /subsystem=elytron/file-audit-log=* /subsystem=elytron/custom-security-event-listener=* /subsystem=elytron/size-rotating-file-audit-log=*

Attributes (8)

format - The format to use to record the audit event.

Type	STRING
Default Value	SIMPLE
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Allowed Values	SIMPLE JSON
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The format to use to record the audit event.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "SIMPLE", "min-length" : 1, "max-length" : 2147483647, "allowed" : [ "SIMPLE", "JSON" ], "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

host-name - The host name to embed withing all events sent to the remote syslog server.

Type	STRING
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The host name to embed withing all events sent to the remote syslog server.", "expressions-allowed" : true, "required" : true, "nillable" : false, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

port - The listening port on the syslog server.

Type	INT
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "The listening port on the syslog server.", "expressions-allowed" : true, "required" : true, "nillable" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

reconnect-attempts - The maximum amount of failed reconnect attempts that should be made for sending messages to a syslog server before the endpoint is closed.

Type	INT
Default Value	0
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "The maximum amount of failed reconnect attempts that should be made for sending messages to a syslog server before the endpoint is closed.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : 0, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

server-address - The server address of the syslog server the events should be sent to.

Type	STRING
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The server address of the syslog server the events should be sent to.", "expressions-allowed" : true, "required" : true, "nillable" : false, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

ssl-context - The SSLContext to use to connect to the syslog server when SSL_TCP transport is used.

Type	STRING
Is the attribute nillable?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The SSLContext to use to connect to the syslog server when SSL_TCP transport is used.", "expressions-allowed" : false, "required" : false, "nillable" : true, "capability-reference" : "org.wildfly.security.ssl-context", "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services" }`

syslog-format - The RFC format to be used for describing the audit event.

Type	STRING
Default Value	RFC5424
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Allowed Values	RFC3164 RFC5424
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The RFC format to be used for describing the audit event.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "RFC5424", "min-length" : 1, "max-length" : 2147483647, "allowed" : [ "RFC3164", "RFC5424" ], "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

transport - The transport to use to connect to the syslog server.

Type	STRING
Default Value	TCP
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Allowed Values	TCP UDP SSL_TCP
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The transport to use to connect to the syslog server.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "TCP", "min-length" : 1, "max-length" : 2147483647, "allowed" : [ "TCP", "UDP", "SSL_TCP" ], "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

Operations (2)

add - Add the audit logger resource.

Request Parameter	Type	Required	Expressions Allowed	Default value	Description
format	STRING	false	true	SIMPLE	The format to use to record the audit event.
host-name	STRING	true	true		The host name to embed withing all events sent to the remote syslog server.
port	INT	true	true		The listening port on the syslog server.
reconnect-attempts	INT	false	true	0	The maximum amount of failed reconnect attempts that should be made for sending messages to a syslog server before the endpoint is closed.
server-address	STRING	true	true		The server address of the syslog server the events should be sent to.
ssl-context	STRING	false	false		The SSLContext to use to connect to the syslog server when SSL_TCP transport is used.
syslog-format	STRING	false	true	RFC5424	The RFC format to be used for describing the audit event.
transport	STRING	false	true	TCP	The transport to use to connect to the syslog server.

Raw DMR model


{
    "operation-name" : "add",
    "description" : "Add the audit logger resource.",
    "request-properties" : {
        "format" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The format to use to record the audit event.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "SIMPLE",
            "min-length" : 1,
            "max-length" : 2147483647,
            "allowed" : [
                "SIMPLE",
                "JSON"
            ],
            "stability" : "default"
        },
        "host-name" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The host name to embed withing all events sent to the remote syslog server.",
            "expressions-allowed" : true,
            "required" : true,
            "nillable" : false,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "port" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "The listening port on the syslog server.",
            "expressions-allowed" : true,
            "required" : true,
            "nillable" : false,
            "stability" : "default"
        },
        "reconnect-attempts" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "The maximum amount of failed reconnect attempts that should be made for sending messages to a syslog server before the endpoint is closed.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : 0,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "server-address" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The server address of the syslog server the events should be sent to.",
            "expressions-allowed" : true,
            "required" : true,
            "nillable" : false,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "ssl-context" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The SSLContext to use to connect to the syslog server when SSL_TCP transport is used.",
            "expressions-allowed" : false,
            "required" : false,
            "nillable" : true,
            "capability-reference" : "org.wildfly.security.ssl-context",
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "syslog-format" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The RFC format to be used for describing the audit event.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "RFC5424",
            "min-length" : 1,
            "max-length" : 2147483647,
            "allowed" : [
                "RFC3164",
                "RFC5424"
            ],
            "stability" : "default"
        },
        "transport" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The transport to use to connect to the syslog server.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "TCP",
            "min-length" : 1,
            "max-length" : 2147483647,
            "allowed" : [
                "TCP",
                "UDP",
                "SSL_TCP"
            ],
            "stability" : "default"
        }
    },
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

remove - Remove the audit logger resource.

Raw DMR model


{
    "operation-name" : "remove",
    "description" : "Remove the audit logger resource.",
    "request-properties" : {},
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

Galleon Features

Galleon features are to be used when creating Galleon feature-packs.

subsystem.elytron.syslog-audit-log

        
<feature spec="subsystem.elytron.syslog-audit-log">
  <param name="syslog-audit-log" value="{resource name}"/>
  <param name="format" value="{value}"/>
  <param name="host-name" value="{value}"/>
  <param name="port" value="{value}"/>
  <param name="reconnect-attempts" value="{value}"/>
  <param name="server-address" value="{value}"/>
  <param name="ssl-context" value="{value}"/>
  <param name="syslog-format" value="{value}"/>
  <param name="transport" value="{value}"/>
<feature/>