Audit & syslog

Taranac keeps an immutable audit trail of every administrative change — who did what, to which object, from which IP, and when — and can forward both that trail and the live AAA logs (TACACS+, RADIUS, NAC) to an external syslog server or SIEM. Together these cover the two questions every audit asks: what happened inside the admin console and can we prove it to an external, tamper-resistant system.

The audit log answers the first question on its own and is always on — there is nothing to enable. Syslog forwarding answers the second: you point Taranac at a collector (Splunk, Elastic, Graylog, rsyslog, QRadar, etc.) and choose which event streams it should ship.

Every state change in Taranac calls into a single audit service, which writes one immutable row and then (fire-and-forget) hands the event to syslog forwarding. Each entry records:

• Event type — one of roughly 150 codes grouped by domain: user lifecycle, groups, RBAC, authentication, MFA, crypto/settings, LDAP config and sync, network objects, devices, TACACS+/RADIUS templates/profiles/command sets/config, AAA policy, NAC (endpoints, policy, PKI, captive portal), backups, and secret reveals.
• Actor — username snapshot plus user ID; empty for automatic/system events.
• Target — type and ID of the affected object.
• IP address and user agent of the request.
• Details — an event-specific JSON payload. For updates this typically records what changed as old → new field diffs, so a row is self-explanatory without cross-referencing.
• Node — on an HA cluster, the node that wrote the entry, stamped best-effort. It is left blank on a standalone install (and for events written before the cluster resolver is available at early boot). Surfaced as a Node column in the audit viewer.
• Timestamp — server time, timezone-aware.

The actor and target are stored as snapshots: even if you later rename or delete the user or object, the audit row still shows who and what it was at the time.

The audit view supports pagination plus filters on event type, actor, target ID / target type, and a date range (from / to), as well as a free-text search across actor, event type, target type and IP. Default sort is newest first (created_at descending); you can also sort by event type, actor or target type.

You can export the current view to XLSX or CSV. Exporting with the page selected gives you exactly what is on screen; exporting without a page gives all matching records up to a hard cap of 10,000 rows. The export columns are: ID, Time, Event Type, Actor, Target Type, Target ID, IP Address, User Agent, Details.

Forwarding is built around three objects — destination (where), binding (what), exclusion (what to suppress) — feeding two independent delivery paths.

Both paths use the same formatter and sender, so everything looks identical on the wire. Path B exists because the AAA daemons write their logs straight into the database; the backend owns those tables and is the natural place to forward from. (Notably, the bundled FreeRADIUS cannot send to a remote syslog itself, so doing it in the backend gives one consistent mechanism across all three protocols.)

Add a syslog destination and set:

Use Test on the destination to send a probe message and confirm the collector receives it before relying on it.

A destination is silent until you bind streams to it. Each binding picks a module and a log type; valid combinations:

Each binding can optionally override the destination’s facility or severity, which is handy for routing one stream to a different SIEM index. A binding is unique per (destination, module, log type).

Log exclusions suppress chatty AAA events (a polling monitor hitting a switch every minute, a service account, an entire subnet). An exclusion matches on who (exact username, username regex, or user group), where (any NAS, a specific network object, or a device group), scope (all / tacacs / radius) and which event types (authentication / authorization / accounting). It then has three independent output toggles:

These toggles are independent — you can keep events in the database for forensics yet stop them flooding the SIEM. The on-disk file backup of AAA logs is always written regardless of exclusions, so suppressing syslog never means losing the forensic copy.

The PRI value is computed the usual way: facility * 8 + severity. Severity is chosen automatically per event:

• Audit events map by type — failures (USER_LOGIN_FAILED, reload-failed, LDAP-sync-failed) → err; security-significant events (deletions, MFA_DISABLED, KEY_ROTATED, every *_SECRET_REVEALED) → warning; logins and config reloads → notice; everything else → info.
• AAA events — authentication failures/rejects and authorization denies → warning; accounting is always info.

A destination’s or binding’s facility/severity override takes precedence over these defaults.

A single line, control characters stripped:

<PRI>Mmm dd HH:MM:SS hostname taranac: event=USER_DELETED actor=admin target_type=user src=10.0.0.5

Includes a structured-data block your SIEM can parse without regex:

<PRI>1 2026-06-24T12:34:56.000000Z hostname taranac - USER_DELETED [taranac eventType="USER_DELETED" actor="admin" targetType="user" targetId="…" src="10.0.0.5" details="{…}"] event=USER_DELETED actor=admin target_type=user src=10.0.0.5

For AAA records the structured data carries protocol, log type, and the relevant fields (username, NAS IP/port, status/action, service, command, rule, profile, session ID). Audit details are serialized as compact JSON and truncated to ~1 KB to keep messages within syslog limits.

Choose CEF to emit events in Common Event Format, wrapped in a syslog envelope — the dialect ArcSight, Microsoft Sentinel and many other SIEMs parse out of the box:

<PRI>Mmm dd HH:MM:SS hostname CEF:0|Taranac|Taranac|<version>|USER_DELETED|USER_DELETED|6|rt=1750766096000 cat=audit act=USER_DELETED suser=admin src=10.0.0.5 cs1Label=targetType cs1=user …

The CEF header carries a fixed vendor and product of Taranac, the running app version, a signature ID and name (the event_type for audit events; PROTOCOL_LOGTYPE, e.g. TACACS_AUTHENTICATION, for AAA logs), and a severity mapped to CEF’s 0–10 scale. The extension carries typed fields — real IPs go into src / dvc, and free-form values into labelled custom strings (cs1…cs6 with csNLabel), so a SIEM never has to guess a field’s type.

The detail that matters for correlation: every CEF event leads with the canonical rt (event-time) field — epoch milliseconds of when the event happened, derived from the same UTC instant as the header timestamp. Your SIEM never has to reconstruct the time from the year-less, timezone-less BSD header, so a slow collector or a timezone gap can’t smear your timeline.

Path B forwards the same authentication, authorization and accounting records you see in the AAA log views. Those records carry snapshot fields (device name and groups, network object, user display name and groups) captured at log time, so they survive renames and deletions.

The authentication log: per-event who / where / outcome, with the same fields the forwarder ships to syslog.

Active sessions are derived from accounting records — the radius/nac accounting streams you bind for syslog.

• Tamper-evidence — audit rows are never edited or deleted in-product; forward system:audit to an external, append-only SIEM so the record lives somewhere the Taranac admins cannot reach.
• Privileged-action visibility — every secret reveal (*_SECRET_REVEALED), key rotation, MFA change and deletion is its own event type; filter or alert on them specifically.
• Retention — the SIEM owns long-term retention; database AAA logs have their own retention setting, while the audit log itself is retained in the database and exported as needed.
• Completeness — keep the on-disk AAA file backup enabled (it ignores exclusions) so forensic data exists even for events you deliberately drop from the DB or SIEM.

• Logging & accounting — the AAA log tables and views that Path B forwards
• AAA policy — the rules whose changes appear as config_change events
• Alerts — in-product alerting, and the third exclusion output
• Roles & permissions — the audit_logs and syslog permissions that gate this section
• Taranac on GitHub