Locate the section starting with this commented line: # Provides TCP syslog reception and uncomment the following two lines: $ModLoad imtcp Locate the section starting with this commented line: # Provides UDP syslog reception and uncomment the following two lines $ModLoad imudp.Switch on syslog listener for rsyslog by making these changes to the /etc/nf file:.The example below describes configuring some settings for syslog on CentOS: You may also need to configure syslog to write the messages as required. For more information, see The Syslog Protocol. The selectable values are: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL, DEBUG. The severity value assigned to the message. Port of the server where syslog is located. An example of an information string in the system log file is: Jan 11 21:34:25 localhost OpenIAM: Action: ClientIP: Principal: Result: Targets:] Information that can be logged can be, for example, client IP address, action, and date and time. Select the information to be logged in syslog from the drop-down list. The default value is OPENIAM.Īudit log information that is exported to syslog. The identity of the system for which messages are logged. The hostname or IP address of the device where syslog is located. By default, the syslog facility is specified as LOCAL0. Select the syslog facility from the drop-down list. The type of program that is logging the messages in syslog. Select this checkbox for enabling tracking actions in syslog. By default, the LOGIN and LOGOUT audit log actions are specified for adding to syslog. Actions that can be logged can be, for example, login, logout, forgot password, and add group. Select the list of actions to be logged in syslog from the drop-down list. Select the roles from the drop-down list. Select the managed system to which the role belongs from the drop-down list.

Specify the roles that are allowed to purge audit data.

Roles which members are allowed to purge audit data The table below describes the fields in the System Audit Log page. This displays a list of properties that can be configured for the system audit log. In the OpenIAM - Property Values page, click on the System Audit Log tab.This displays the OpenIAM - Property Values page. In Webconsole, click on the Administration tab and select System Configuration.You can configure the system audit log properties from the System Configuration menu. This section describes configuring the system audit log properties ( Configuring the system audit log), viewing audit log records using the log viewer ( Viewing audit logs), and audit log timing ( Audit logging time zone rules). 'User Becomes a Member of Group A' at 12 PM.'Provision User' to AD target system at 12 PM.For example, if you create a new user and then provision the user, the following event audit trail is logged for the sequence of activities: The audit log provides an ability to build an audit trail of the logging event. Each event can have different audit log entries. These are some of the many audit log entries that can be viewed for an event. the page on which this event was initiated.error code, if any, generated and reason for the error.

the date and time when the operation was performed.the IP address from where this operation was performed.This information is useful for troubleshooting problems.įor example, an administrator can view a document log for an event that contains audit log entries, such as: The log viewer feature ensures that detailed information about events and activities associated with identities or resources are logged into a centralized repository and can be tracked. Audit service – which takes care of logging the eventsĪudit events are signed so that any tampering of events can be detected.Queue – where audit events are published.

Event collectors which collect audit events.

The audit service consists of the following components:

Linked events where a large transaction such as provisioning may trigger other events.

Auditing is an essential part of an identity governance and web access management platform and the OpenIAM audit functionality allows for logging of virtually all types of events such as: OpenIAM provides the capability of logging the sequence of activities performed in the system (audit logging) and viewing this log of events using the Log Viewer functionality ( Webconsole → Administration → Log Viewer).

Agent activity audit