Struct SyslogForwardSection 

pub struct SyslogForwardSection {
    pub host: String,
    pub facility: u8,
    pub enterprise_number: u32,
}

[audit.forward.syslog] section.

Example:

[audit.forward.syslog]
host = "siem.internal:514"
facility = 1            # 1 = user-level (default)
enterprise_number = 99999  # your own IANA PEN; defaults to the doc/test PEN

Fields

host: String

Receiver address (host:port). Mandatory.

facility: u8

Syslog facility number (default 1 = user-level messages).

enterprise_number: u32

IANA Private Enterprise Number used to build the syslog SD-ID (sysknife@<enterprise_number>, see RFC 5424 §7.2.2).

Defaults to DOCUMENTATION_PEN, RFC 5612’s reserved documentation/test PEN — see the warning comment on format_rfc5424 in sysknife-daemon::audit_forward. Operators forwarding into a regulated SIEM should set this to their own assigned PEN; see SyslogForwardSection::validate.

Implementations

impl SyslogForwardSection

pub fn validate(&self) -> Result<(), String>

Reject an enterprise_number of 0, which is not a valid IANA PEN (the registry’s enterprise-numbers file starts numbering at 1). Called at config-parse time, alongside any facility validation.

Every other u32 value is accepted: IANA PENs are allocated sequentially with no reserved upper gap, so any nonzero u32 is a syntactically valid PEN even if it has not actually been assigned to this operator.

Trait Implementations

impl Debug for SyslogForwardSection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SyslogForwardSection

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.