https://github.com/rsatrio/keycloak-graylog-integration

https://github.com/rsatrio/keycloak-graylog-integration

Last synced: 10 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/rsatrio/keycloak-graylog-integration
• Owner: rsatrio
• Created: 2021-06-04T08:24:25.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2021-06-04T08:31:27.000Z (over 3 years ago)
• Last Synced: 2024-04-24T11:57:40.809Z (7 months ago)
• Size: 8.79 KB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
## Keycloak Logging to Graylog (or other Syslog server)

Below are steps to sending keycloak's event logging to graylog:

1. Setup syslog as one of graylog's input. Note the IP Address port, and protocol (TCP/UDP) for the syslog input

   https://www.graylog.org/post/how-to-use-graylog-as-a-syslog-server

2. Activate Event Logging in Keycloak's realm from its admin console:

   https://www.keycloak.org/docs/latest/server_admin/index.html#auditing-and-events

3. Open $KEYCLOAK_HOME/standalone/configuration/standalone.xml

4.  Add below line under 

                   

                   

                       

                   

                   

                       

                       

                       

                       

                       

                   

               

    

                   

                   

                       

                   

               

   ```

5. Start keycloak and check logging.properties under standalone's configuration folder($KEYCLOAK_HOME/standalone/configuration/logging.properties), the configuration should now contain handler with name graylog

6. Try to login to one of the keycloak's client (i.e account) using false username/password. There should be log(s) sent to graylog by keycloak