Source Adding via SFTP

First of all, you need to create a user on your local Linux machine with the following command;

#Adduser logsignLogger

• The user named logsignLogger has been created.
• The password was entered twice as abc123654.

Then, you can get logs from specific paths in the Linux machine over SFTP. Note: Logsign's parser for this integration expects lines in the Linux Audit Framework's own format (type=... msg=audit(...): key=value ...), which is what /var/log/audit/audit.log contains by default on systems running auditd. Generic syslog/kernel/auth log files (kern.log, auth.log, syslog.log) are plain free-text and are not in this format, so pointing this source at them will not produce parsed events with this integration.

Ex: /var/log/audit/audit.log

In Logsign;

1. Go to Settings > Data Collection and click + Device, then choose SFTP as the source type.
2. Host: the IP address of the Linux machine.
3. Port: 22 (SFTP's standard port, unless your SSH daemon uses a non-default port).
4. Username / Password: the logsignLogger account credentials created above. Make sure this account has read access to the log file/directory (for example via group membership, since /var/log/audit/audit.log is typically root-readable only by default).
5. Directory / File Path: the full path to the file to read, for example /var/log/audit/audit.log.
6. Fill in the remaining standard fields (Period, Data Policy, Device Name, and so on) as with any other Logsign source, then click Save.