Module audit_forward 

External audit log forwarding (RFC 5424 syslog over UDP).

After each transactions row is recorded, the daemon hands a structured AuditEvent to a per-sink forwarder task over a bounded tokio::sync::mpsc::channel. The forwarder formats the event per the configured wire protocol and emits it. Forwarding is fire-and-forget: channel send failures (try_send returning Full/Closed) increment a drop counter and emit an eprintln! warning after DROP_WARN_THRESHOLD consecutive drops; the audit-log INSERT path itself never awaits or fails.

Wire protocols

Phase 1 ships RFC 5424 syslog over UDP, the de-facto on-host log-forwarding format. Direct ingestion works with Splunk, Elastic, IBM QRadar, and rsyslog; vendors that require a forwarder agent (Microsoft Sentinel via the Azure Monitor Agent on a Linux VM, Datadog/Chronicle via their own collectors) consume the same stream through that agent. CEF and NDJSON-over-TCP are designed-for in AuditSinkSpec and arrive in follow-up PRs.

Reliability vs durability

• Local audit-log INSERT (Ed25519-signed hash-chained, see audit_chain) is the durable record.
• External forwarding is best-effort. A SIEM outage, a routing flap, or a misconfigured collector must NEVER block daemon execution.
• We do not retry the send in-process: a frame that the kernel could not hand to the SIEM is dropped and the next event continues. Bind failures are retried with exponential backoff (1s → 60s) so a transient outage does not poison the socket forever, but neither path tries to replay the missed event — the SIEM is the long-lived accumulator and the local hash-chained log will catch up the operator on the next ingest. (A future “tail watermark + replay” Phase 2 bridge can reconcile gaps from the local log.)

Structs

AuditEvent

One audit event handed to the forwarder. Mirrors the chain content captured at INSERT time so SIEM rules can correlate by transaction_id and request_hash against the local hash-chained log.

AuditForwarder

A handle the daemon writes to. Cheap to clone (Arc-wrapped sender + counter). Returns immediately on submit.

Enums

AuditSinkSpec

Configuration for one forwarding sink.

Constants

DOCUMENTATION_PEN

RFC 5612’s reserved documentation/test Private Enterprise Number. Kept here (mirroring sysknife_core::config::DOCUMENTATION_PEN) so this crate’s tests and doc examples don’t need a cross-crate import just to name the default PEN.

DROP_WARN_THRESHOLD

Emit a single WARN to stderr after this many consecutive try_send drops. Counter resets on a successful send.

FORWARDER_QUEUE_DEPTH

Bounded queue depth between daemon and forwarder. Sized for ~5 minutes of audit events at the daemon’s sustainable record rate (well below SIEM ingest); a sustained burst that overflows is a SIEM outage and we drop (with counter + WARN) rather than back-pressure the audit-log writer.

Functions

format_rfc5424

Format event as a single RFC 5424 syslog message.

spawn

Spawn a forwarder task that consumes events from rx and sends them to spec. Returns the AuditForwarder handle the daemon writes to.