Install Pando

Syslog

syslog Sends every audit event, as it is written, to a syslog collector as an RFC 5424 message over TCP, encrypted with TLS unless you turn it off. A copy of the audit log leaves this installation.

Setup

  1. Connect to your collector

    Settings address, tls

  2. Add certificates

    Settings ca_certificate, client_certificate, client_key · Only when tls is on or

  3. Choose events

    Settings actions, exclude

Settings (15)
addressAddressRequired

The collector's host and port. Without a port, 6514 with TLS and 514 without.

string · For example siem.example.com:6514

tlsTLS

Off sends the audit log in the clear.

  • on On — TLS, as RFC 5425 describes.
  • off Off — Plain TCP, for a collector on the same host or a trusted network.

one of the values above · Default on

ca_certificateCA certificate

PEM certificates of a private certificate authority to trust. Empty trusts the system's.

string · Used when tls is on or

client_certificateClient certificateCredential

PEM, for a collector that requires mutual TLS. Set with its key, or not at all.

string · Used when tls is on or

client_keyClient keyCredential

The client certificate's PEM private key. Stored encrypted.

string · Used when tls is on or

server_nameServer nameAdvanced

The name the collector's certificate must carry, when it differs from the address.

string · Default the address's host

app_nameApp nameAdvanced

The APP-NAME each message carries.

string · Default pando

facilityFacilityAdvanced

The syslog facility messages are sent as. authpriv is for security messages a collector keeps apart from the general log.

  • authpriv
  • auth
  • daemon
  • user
  • local0
  • local1
  • local2
  • local3
  • local4
  • local5
  • local6
  • local7

one of the values above · Default authpriv

hostnameHostnameAdvanced

The HOSTNAME each message carries.

string · Default this machine's hostname

timeout_secondsTimeoutAdvanced

Seconds to wait to connect, and for a batch to be written.

int · Default 10

actionsActions

Comma-separated action prefixes to send. Empty sends every event.

string · For example deploy, install.

excludeExclude

Comma-separated action prefixes not to send. app.use, a record of each request to an app, is usually most of the volume; exclude it if your SIEM bills by ingest.

string · For example app.use

formatEvent formatAdvanced

How each event is encoded.

  • native Native — The event as Pando stores it.
  • ocsf OCSF — OCSF 1.3.0, for a SIEM that maps it.

one of the values above · Default native

max_batchBatch sizeAdvanced

The most events sent in one delivery.

int · Default 200

startStartAdvanced

Where a new destination's first delivery begins. Read once, when Pando first sends to it.

  • oldest The oldest event in the live log
  • now Only events from now on

one of the values above · Default oldest