Keycyte PAM 3.2 · Administrator Guide

Forwarding Logs to Syslog

Keycyte PAM can forward its audit records to syslog servers as they are written, so that a SIEM or a central log server receives them without polling. You can add several syslog targets; each target has its own protocol and its own selection of record types.

To open the page, select Settings > Syslog Settings.

How Forwarding Works

• Records are sent to every enabled target, each according to its own record-type selection.
• Messages use the RFC 5424 syslog format with the application name keycyte-pam and the user facility. The message body is a JSON object with the same fields that the Admin Panel shows when you expand a log row.
• Each target has its own connection and queue. A slow or unreachable target does not delay the others or the user’s request. Keycyte PAM retries a failed target after a short pause; if a target’s queue fills up, new records for that target are dropped.
• Changes on the page take effect immediately, without a restart.

Adding a Syslog Target

Before you begin, make sure that the syslog server is reachable from the Keycyte PAM server on the port you plan to use. For TCP+TLS, the syslog server’s certificate must be trusted by the operating system of the Keycyte PAM server.

To add a target:

1. Click Add. The Syslog Server dialog opens.

2. Specify the following settings:

   Field	Description
   Protocol	UDP (default), TCP, or TCP+TLS. TLS connections use TLS 1.2 or later and verify the server certificate.
   Address	Host name or IP address of the syslog server, for example 10.0.0.20.
   Port	Port of the syslog server. Default: 514.
   Client Log	Forward Client log records.
   System Log	Forward System log records.
   ACL Log	Forward Access log records (sign-in attempts and sign-outs).
   Access Control	Forward access requests (Access Control log).
   Password Manager	Forward password change and verification events.
   Command	Forward the commands run in terminal sessions.
   File Transfer	Forward file transfer records of terminal sessions.
   Status	Enables the target. A disabled target receives nothing.

3. Click Save.

The target appears in the list with a column for each record type. To change a target, click its edit button; to remove it, click its delete button.