Audit Forwarding to SIEM

Athena writes every security-relevant action to an audit trail that you can read and query in the console. When you also need those events in a central SIEM — for long-term retention, correlation, or compliance — turn on audit forwarding and Athena will stream each event to a syslog collector as it happens. Forwarding runs in addition to the local audit log, so you keep the searchable on-box trail and gain an off-box copy at the same time.

Forwarding is additive — you don't lose the local log

Enabling forwarding does not replace the primary audit provider. Events are written to the local audit log (File or database) and forwarded to your collector. The console keeps reading the local trail through api/Audit, exactly as before.

How forwarding works#

When forwarding is enabled, every audit event Athena records is also queued for delivery to the syslog target you configure. Events are buffered and sent in batches; once the buffer reaches its configured size the batch is flushed to the collector. The buffer is also flushed when the server shuts down, so pending events are delivered on a clean stop.

Delivery is isolated from the local log. If the collector is unreachable — a dropped UDP packet, a closed TCP port, DNS trouble — the local audit trail is never affected; the forwarding failure is contained and the on-box record stays complete. Because forwarding is one-way and stream-only, it is a write path: you query and browse audit history from the local provider, not from the SIEM connection.

Turning it on#

In the console, open Settings → Logging and find the Audit Forwarding section. Tick Enable syslog forwarding, then fill in where and how to send events:

Field	What it sets	Default
Syslog Host	Hostname or IP address of your syslog collector or SIEM ingest point.	(empty)
Port	UDP or TCP port the collector listens on.	`514`
Transport	Network transport — `Udp` or `Tcp`.	`Udp`
Message Format	Wire format for each event — `Rfc5424`, `Rfc3164`, `Cef`, or `Json`.	`Rfc5424`
Facility	Standard syslog facility (for example `local0 (16)`) so your collector can route Athena events into their own stream.	`local0 (16)`
Buffer Size	How many events to accumulate before flushing a batch to the collector.	`10`

Click Save to store the settings. Both a host and the enabled toggle are required for forwarding to start — if the host is left blank, forwarding stays off.

Changes take effect after a restart

Audit-forwarding settings are applied when the server starts, so a change to the toggle, host, transport, or format takes effect after the next application restart. The settings page shows a reminder when forwarding is enabled. Plan the change during a maintenance window.

Choosing a transport#

UDP (default) — the classic syslog transport. It is lightweight and fire-and-forget: messages are sent without a delivery guarantee, so an occasional packet can be lost under network pressure. Use it when your collector and the server share a reliable local network.
TCP — a connected transport that gives you reliable, ordered delivery and reconnects automatically if the link drops. Prefer TCP when events cross network boundaries or when you cannot tolerate lost audit records. Point it at the TCP syslog port your collector exposes.

Message formats#

Athena can emit each event in four formats. Pick the one your SIEM parses most cleanly:

Format	Best for
`Rfc5424`	Modern structured syslog. Recommended for most SIEM systems. Each event carries structured data (event type, event ID, actor, source, resource, action, agent) plus a human-readable message.
`Rfc3164`	Legacy BSD syslog for older syslog servers that don't understand RFC 5424.
`Cef`	Common Event Format — best for ArcSight and other enterprise SIEMs that ingest CEF.
`Json`	A JSON object per event — best for the Elastic (ELK) stack, Splunk HEC, or a custom ingest pipeline.

Every format includes the standard syslog priority (facility × 8 + severity) so your collector can filter by severity. Athena maps its audit severities to syslog levels as follows:

Audit severity	Syslog level
Debug	7 — Debug
Information	6 — Informational
Warning	4 — Warning
Error	3 — Error
Critical	2 — Critical

A forwarded RFC 5424 event looks like this on the wire (a failed login, wrapped for readability):

<132>1 2026-07-19T14:30:00.123Z ATHENA-SRV Athena - a1b2c3d4-… \
  [athena@0 eventType="LoginFailure" eventId="a1b2c3d4-…" success="False" \
  schemaVersion="1.0" user="jsmith" src="10.0.0.42" resourceType="User" \
  resourceId="jsmith" action="Login"] Failed login attempt for user 'jsmith'

Each event carries a schema version and a unique event ID, so downstream searches and correlation rules stay stable as the product evolves.

What gets forwarded#

Forwarding uses the same event catalog as the local trail — there is one stream of audit events, written locally and (when enabled) mirrored to your SIEM. That includes logins and logout, password and role changes, agent registration and revocation, deployment and command execution, scheduled-job changes and runs, token generation, settings changes, and server start/stop, among others. See Audited events for the full list. Each event carries the actor, source IP, affected resource, action, outcome, and severity.

Delivery & buffering#

Events are flushed to the collector once the buffer reaches its configured Buffer Size (default 10), and again when the server shuts down. If you want events to arrive with less delay on a quiet server, lower the buffer size so batches flush sooner; if you would rather send fewer, larger batches, raise it. Whatever the setting, the local audit log is always written immediately — buffering only affects the pace of the forwarded copy.

Air-gapped by default — forwarding is opt-in

Athena runs fully on-premises and sends nothing off-box unless you configure it. Audit forwarding is off out of the box; when you enable it, events go only to the syslog host you name — typically a SIEM inside the same isolated network. See Air-Gapped Operation.

Troubleshooting#

No events reaching the collector. Confirm the Enable syslog forwarding toggle is on and the Host field is not blank — both are required — and that you restarted the server after saving. On a fresh enable, generate an event (for example, sign in and out) to trigger activity.
Events appear only in bursts. That is the buffer at work. Lower the Buffer Size to have batches flush sooner.
Intermittent loss over UDP. UDP is fire-and-forget; switch the Transport to TCP for reliable, ordered delivery across less-reliable links.
Collector rejects or mis-parses messages. Match the Message Format to what your SIEM expects — Cef for ArcSight, Json for ELK or Splunk HEC, Rfc3164 for legacy syslog servers, Rfc5424 for everything else — and confirm the Facility lines up with any inbound routing rule on the collector.
Firewall. Make sure the chosen Port and transport are open from the Athena server to the collector.

A change to the forwarding settings is itself recorded in the audit trail as a settings change, so you always have a record of who turned forwarding on or off and when. The local audit log remains the source of truth for querying history — see Querying the audit log.

Audit & SIEM — the audit trail, the events it records, and how to query it.
Configuration — server settings that are applied at startup.
Air-Gapped Operation — running fully on-premises with no outbound calls.
Roles & Permissions — who can view settings and the audit trail.