I have a requirement as part of our Enterprise Security Policy that states all applications should be able to routinely generate log data around user activity and send it to a centralized log monitoring solution for review. The Audit Log file contains all the data necessary to meet this requirement, however, it's only possible to generate this file manually by clicking on the button in the UI.
I'd like to request functionality that allows for any of the below options:
Scheduled execution of the generation of this report (with a customizable schedule) to a folder on the QEM server
An endpoint within the QEM API to request this data as a stream or file
The ability to configure QEM to automatically emit this data out in realtime (as it happens) to an external system
Very happy to hear that this will be released in April '21! I'm in an active POC right now where the prospect has the same requirement. Prospect needs to be able to continuously consume the QEM Audit Trail log using an API. During the POC, prospect communicated a broad requirement to be able to consume as much log data as possible into Splunk. The goal is to mine all available information across systems to be able to generate end to end insights (using analytics, ML, and AI) and move towards addressing issues proactively before they occur.
We have similar security policy requirement. However, the solution discussed here looks cumbersome to me. It would require us to configure a separate module to read the audit logs from API and ship it to centralized log repository.
This information is already logged to <Enterprise Manager installation folder>\data\AuditTrail\audit_service location, however is not readable. I would like to request an enhancement to make this plaintext and readable OR simply log this information to the general Enterprise Manager log file.
Most logging tools like Elastisearch, Splunk, Cloudwatch and other provide log forwarding capabilities. I can simply hookup a filebeats agent or logstash to ship the audit log file to Elasticsearch for further analysis.
