Forwarding Raw Audit Events from the ECA

Introduction

This is a different mechanism from alarm forwarding: that page forwards Eyeglass alarms (operational events, alarm codes). This page forwards the raw audit event stream the ECA ingests for Queries and Reports — the same underlying events queried there — to an external syslog server for long-term retention or SIEM ingestion, independent of the audit database itself.

The ECA runs an optional Docker container, syslogpublisher, that consumes this event stream and forwards it to an external syslog server over UDP, for direct SIEM ingestion.

Forwarding to an External Syslog Server

1. SSH to each ECA node that should forward events, as ecaadmin. Each node forwards independently, so repeat this on every node you want to enable (a common pattern is all nodes except node 1).

2. Edit the syslog appender configuration:

   vim /opt/superna/eca/conf/syslogpublisher/log4j2.xml

   Set the syslog server's IP address and UDP port (default syslog port is 514; the file ships with a placeholder port of 5140 — change it to match your syslog server).

3. Enable the container to start on the desired nodes by adding it to the Docker Compose overrides file:

   vim /opt/superna/eca/docker-compose.overrides.yml

   Add a syslogpublisher service entry with eca.cluster.launch.all: on under its labels, matching the indentation of existing entries.

4. Push the configuration to all nodes:

   ecactl cluster push-config

5. Start the container on the nodes that should forward:

   ecactl cluster exec "ecactl containers up -d syslogpublisher"
   note

   This starts the container on every node, including node 1. If node 1 should not forward, stop and remove it there specifically:

   ecactl containers stop syslogpublisher
   ecactl containers rm syslogpublisher

6. Monitor forwarding activity from any node running the container:

   ecactl logs --tail 200 --follow syslogpublisher

   This reports the rate of events received and sent, updated roughly every minute.

Example Forwarded Event

2019-07-07T20:59:40.816Z syslogpublisher.node1.demoeca.eca.local ECA 1 AuditLogs - {"eventCode":"0x40","path":"\\\\<cluster-guid>\\System\\ifs\\data\\policy1\\search\\cow.txt","protocol":"SMB2","server":"node001","clientIP":"..."}

Filtering Before Forwarding

To forward only a subset of events (for example, a specific path), add a RegexFilter to the Syslog appender in log4j2.xml:

<Syslog name="SupernaSyslog" format="RFC5424" facility="LOCAL0"
  host="<syslog-server-ip>" port="514" protocol="UDP" appName="ECA"
  messageId="AuditLogs" id="Event" connectTimeoutMillis="10000"
  newLine="true" mdcId="mdc" includeMDC="true" enterpriseNumber="18060">
  <RegexFilter regex=".*ifs.*data.*smb01.*test123.*" useRawMsg="true" onMatch="ACCEPT" onMismatch="DENY"/>
</Syslog>

To exclude a path instead of matching one (for example, excluding internal housekeeping events), use a negative-lookahead pattern:

<RegexFilter regex="^((?!.*ifsvar.*).)*$" useRawMsg="true" onMatch="ACCEPT" onMismatch="DENY"/>

Path is the most common filter field, but the same RegexFilter approach works against any field present in the raw event JSON (user SID, event code, and so on) — review the example event above to build a pattern for other fields.

After any change to log4j2.xml, push the configuration and restart the container on all nodes:

ecactl cluster push-config
ecactl cluster services restart --container syslogpublisher --all

Troubleshooting

If your syslog server isn't receiving messages, first confirm firewall access and the configured port, then:

1. Use the monitoring command above to confirm which ECA node(s) are actively forwarding.

2. On that node, capture UDP traffic directly:

   sudo -s
   zypper in tcpdump
   tcpdump -i eth0 udp port 514

   A successful send appears as an outbound SYSLOG packet to your configured destination host.

See Also

• Queries and Reports — Query and analyze the same audit event stream directly from Eyeglass, rather than forwarding it externally.
• Alarm Forwarding (Syslog) — Forward Eyeglass alarms (a different event type) by syslog.