Log forwarding sends a copy of every audit event to another system, such as a SIEM, a log collector or your own application. Each change made in AD Pro Toolkit, and who made it, is sent as it happens.
The audit log under Settings > Logs is always kept in AD Pro Toolkit too. Forwarding is a copy, not a replacement.
To set it up, go to Settings > Log forwarding.
Add a destination
- Go to Settings > Log forwarding and select Add destination.
- Enter a Name, for example
SIEM. - Choose a Protocol. See Protocols.
- For syslog, enter the Hostname or IP and the Port. For a webhook, enter the Webhook URL.
- Choose the Event format: CEF (Common Event Format) or JSON. Use whichever your system expects. Most SIEMs read CEF.
- Make sure Enable is ticked.
- Select Test connection. A test event is sent. Check that it arrived at the destination.
- Select Save destination.
You can add more than one destination. Every enabled destination gets every event.
Protocols
| Protocol | Default port | Use it when |
|---|---|---|
| Syslog (TCP) | 514 | Your collector accepts syslog over TCP. |
| Syslog (TLS) | 6514 | Your collector accepts encrypted syslog. Recommended if it's supported. |
| UDP (Syslog) | 514 | Your collector only accepts syslog over UDP. Events can be lost without any error. |
| Webhook (HTTPS) | In the URL | You're sending to a web service. Each event is sent as an HTTPS POST. |
Syslog messages use the RFC 5424 format, one event per line.
Manage destinations
The Configured destinations table shows each destination and its Status:
- Active: enabled, and the last event was sent.
- Error: the last event couldn't be sent. Select Test from its ⋯ menu to see why.
- Disabled: not sending.
From the ⋯ menu on a row you can Edit, Test, Disable or Enable, and Delete a destination.
Things to know
- Events are sent once. If a destination can't be reached, that event isn't sent again later, and the destination shows Error. The event is still in the audit log in AD Pro Toolkit.
- Sending never slows down the app. Events are sent in the background, so a slow or unreachable destination doesn't delay anyone's work.
- Open the firewall from the computer AD Pro Toolkit is installed on to the destination's port.
Troubleshooting
- "Could not reach the destination" when testing: check the hostname or URL and the port, and that the firewall allows the connection.
- The test succeeds but nothing arrives: check the destination is listening on the same protocol, for example TCP rather than UDP, and expects the format you chose.
- A destination shows Error: select Test from its ⋯ menu to see the error, fix the problem, and test again.