Is there a topic that captures ACL logs or is there a way to forward them to an external system?

rjohnson

I'm working on a logging strategy document, and I'm trying to determine if there's a way to capture ACL logs from a Solace Cloud environment and forward them to an external system. I'm open to using any method REST Delivery Point, syslog forwarding, etc.

I'm aware that system, client and vpn logs are sent to a topic #LOG, but that doesn't seem to include ACL logs.

Thanks!

marc

Hi @rjohnson,

I think the logs you are looking for are likely in the client logs. You can find the list of syslog events here: https://docs.solace.com/Admin-Ref/Solace-PubSub-Event-Reference/event_ref_boiler.html

You can also see how you can subscribe to only the events you want to receive when listening to these over the message bus on this page: https://docs.solace.com/Monitoring/Subscribing-to-MBus-Events.htm

Hope that helps!

rjohnson

@marc - Thank you for the comment. I didn't see those nested in the system logs. I was also thinking that the acl logs created an event for both allow and denial activities, but upon looking close at this page https://docs.solace.com/Security/Managing-Access-Control-Lists.htm#Viewing-ACL-Logs it looks like it is just denials.

marc

Hi @rjohnson,

I think the logs you are looking for are likely in the client logs. You can find the list of syslog events here: https://docs.solace.com/Admin-Ref/Solace-PubSub-Event-Reference/event_ref_boiler.html

You can also see how you can subscribe to only the events you want to receive when listening to these over the message bus on this page: https://docs.solace.com/Monitoring/Subscribing-to-MBus-Events.htm

Hope that helps!

rjohnson

@marc - Thank you for the comment. I didn't see those nested in the system logs. I was also thinking that the acl logs created an event for both allow and denial activities, but upon looking close at this page https://docs.solace.com/Security/Managing-Access-Control-Lists.htm#Viewing-ACL-Logs it looks like it is just denials.