Configuring Syslog for Passwork events

When the Write the activity log to syslog or the Windows event log setting is enabled, events are forwarded to ./log/php/syslog by default. Other messages received through rsyslog can end up in the same file as well. You can configure logging so that Passwork events are:

1. Written to a separate file
2. Sent to a SIEM
3. Forwarded to stdout

Forwarding to a separate file

shell

module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   -/server/www/app/logs/passwork_events
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf

Sending to a SIEM

shell

module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   @@<SIEM_IP>:<SIEM_PORT>
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf

Replace <SIEM_IP> and <SIEM_PORT> with the address and port of your SIEM system.

Forwarding to stdout

shell

module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   -/proc/1/fd/1
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf