Commands / kosa8 audit forward

kosa8 audit forward

Ship audit entries to the configured SIEM sinks (syslog, Splunk HEC, HTTPS)

Sends every audit entry a sink has not yet received, in order, with its sequence number and chain hashes, so the receiving side can prove nothing was dropped or edited. Each sink keeps a durable cursor: an interrupted run resumes where it stopped, and a resent record is recognisable by its sequence number.

kosa8d forwards on its own while it runs; this command is for testing a sink, catching one up now, or running a forwarder yourself (--follow).

Sinks are configured in ~/.kosa8/audit-config.json. Credentials are named by file or environment variable, never written there:

{ "sinks": [ {"name": "siem", "type": "syslog", "address": "siem.example.gov:6514", "ca_file": "/etc/pki/siem-ca.pem", "cert_file": "/etc/pki/kosa8.pem", "key_file": "/etc/pki/kosa8.key"}, {"name": "splunk", "type": "splunk-hec", "url": "https://splunk.example.com:8088", "token_file": "/etc/kosa8/hec.token"} ], "retention": {"max_age_days": 400, "min_entries": 10000} }

With KOSA8_OFFLINE=1 this refuses at once instead of waiting on the network.

Options

Example

  kosa8 audit forward
  kosa8 audit forward --sink splunk
  kosa8 audit forward --follow