# Sender: tail the Pandora FMS Console audit log and
# forward it to the receiver via TCP port 10514. The dedicated ruleset is
# required to ensure that ONLY the audit log is sent, not the entire
# system journal.
module(load="imfile")

ruleset(name="RemoteAuditFwd") {
    action(type="omfwd"
        target="10.0.0.1"
        port="10514"
        protocol="tcp"
        action.resumeRetryCount="-1"
        queue.type="linkedList"
        queue.filename="pandora_audit_fwd"
        queue.saveonshutdown="on"
    )
}

input(type="imfile"
    File="/var/www/html/pandora_console/log/audit.log"
    Tag="pandora-audit"
    Severity="info"
    Facility="local0"
    ruleset="RemoteAuditFwd"
)