{"id":19398900,"url":"https://github.com/pschiffe/ipa-log-config","last_synced_at":"2025-07-03T11:04:38.641Z","repository":{"id":32843196,"uuid":"36436725","full_name":"pschiffe/ipa-log-config","owner":"pschiffe","description":"Tool for log forwarding configuration on IPA servers and clients","archived":false,"fork":false,"pushed_at":"2019-09-29T12:59:54.000Z","size":23,"stargazers_count":32,"open_issues_count":4,"forks_count":14,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-07-01T02:51:26.888Z","etag":null,"topics":["audisp-syslog-plugin","audit","centralized-logging","freeipa","ipa-server","rsyslog","sssd"],"latest_commit_sha":null,"homepage":"https://www.freeipa.org/page/Centralized_Logging","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pschiffe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-05-28T12:24:59.000Z","updated_at":"2025-04-07T06:05:00.000Z","dependencies_parsed_at":"2022-09-23T16:02:06.309Z","dependency_job_id":null,"html_url":"https://github.com/pschiffe/ipa-log-config","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/pschiffe/ipa-log-config","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pschiffe%2Fipa-log-config","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pschiffe%2Fipa-log-config/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pschiffe%2Fipa-log-config/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pschiffe%2Fipa-log-config/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pschiffe","download_url":"https://codeload.github.com/pschiffe/ipa-log-config/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pschiffe%2Fipa-log-config/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263314159,"owners_count":23447294,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audisp-syslog-plugin","audit","centralized-logging","freeipa","ipa-server","rsyslog","sssd"],"created_at":"2024-11-10T11:07:37.487Z","updated_at":"2025-07-03T11:04:38.609Z","avatar_url":"https://github.com/pschiffe.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ipa-log-config\n\nA tool for log forwarding configuration on IPA servers and clients. Configures rsyslog to collect and forward selected log files to desired remote server. For more information about this effort and some inspiration what can be done with those logs, visit [this page](https://www.freeipa.org/page/Centralized_Logging).\n\n## Usage\n\n```\n# ./ipa_log_config.py --target \u003cdomain name or ip of target server\u003e\n```\n\nTo revert changes done by this script, use the `--revert` option:\n\n```\n# ./ipa_log_config.py --revert\n```\n\n## Supported platforms\n\nCurrently, only RHEL 7 / CentOS 7 and derivates are supported.\n\n## Requirements\n\nThe script requires `python2-sssdconfig` package.\n\n## Detailed description\n\nThis tool tries to be as not invasive as possible. The rsyslog configuration is done in the separate files, which could be easily removed. Besides that, it configures debug level of SSSD and enables audisp syslog plugin. All logs are written to their original destination AND sent to the remote server, so no logs are lost from the local machine.\n\n### Forwarded logs\n\n```\n/var/log/audit/audit.log\n/var/log/secure\n/var/log/httpd/access_log\n/var/log/httpd/error_log\n/var/log/kadmind.log\n/var/log/krb5kdc.log\n/var/log/pki/pki-tomcat/ca/transactions\n/var/log/dirsrv/slapd-\u003cREALM\u003e/access\n/var/log/dirsrv/slapd-\u003cREALM\u003e/audit\n/var/log/dirsrv/slapd-\u003cREALM\u003e/errors\n/var/log/sssd/sssd.log\n/var/log/sssd/krb5_child.log\n/var/log/sssd/ldap_child.log\n/var/log/sssd/selinux_child.log\n/var/log/sssd/gpo_child.log\n/var/log/sssd/sssd_nss.log\n/var/log/sssd/sssd_pam.log\n/var/log/sssd/sssd_pac.log\n/var/log/sssd/sssd_autofs.log\n/var/log/sssd/sssd_ssh.log\n/var/log/sssd/sssd_sudo.log\n/var/log/sssd/sssd_ifp.log\n/var/log/sssd/sssd_\u003cDOMAIN\u003e.log\n```\n\nMost of the logs are forwarded using rsyslog imfile module. The only exceptions are audit and secure logs. Audit is sent to rsyslog using audisp syslog plugin and secure log is written directly by rsyslog, so only forwarding is added for this one. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpschiffe%2Fipa-log-config","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpschiffe%2Fipa-log-config","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpschiffe%2Fipa-log-config/lists"}