access to audit logs

[maxilee]

hi.
how can we access audit logs without web GUI ? or how can I send this audit logs to syslog ( local or remote ) or write to file ?

 

[Carles Munyoz]

Hi,
You can access all the audit logs by means of this icon in the after login screen:

For the audit logs of a concrete FWCloud:

And for the audit logs for a firewall or cluster:


Greetings.

 

[maxilee]

I know that.
but i'm asking without web GUI
API ?
any script ?

 

[Carles Munyoz]

Ok, sorry me.
You can see them in the fwcloud-api logs in the directory: /opt/fwcloud/api/logs

 

[maxilee]

I'v already checked these logs.

-rw-r--r--.  1 fwcloud fwcloud 46178478 Jul 16 15:55 app.log
-rw-r--r--.  1 fwcloud fwcloud  8895257 Jul 16 15:52 http.log
-rw-r--r--.  1 fwcloud fwcloud        0 Nov  4  2024 query.log

but they doesn't contain audit logs which I can see via web UI.
in web UI I can see which user made anych changes, installed firewall etc ...

maybe I'v not enabled something.

I know that audit logs exists in database

MariaDB [fwcloud]> select * from audit_logs;

[cut]

 

[Carles Munyoz]

I'm sorry but at this moment such logs are only available in the fwcloud-ui or in the database.

 

[maxilee]

ok. I understand.
maybe this will be usefull for someone.
I'll describe my setup.

I've created new table in DB audit_logs_queue and trigger which copy new records from audit_logs ( in my table I've disable autoincremental on ID filed ).
then I've write python script which fetch records from table audit_logs_queue and send then to syslog , and if sending was successfull - scripts remove record from DB.

work perfect and I've not modified any part of fwclodu

 

[Carles Munyoz]

Hi,
Great work!
We will have in mind for a future release include the option to send audit logs to syslog.