provide a way to send logs to syslog server

[jhill]

I have a need to export my audit (and perhaps process and object) logs to our central syslog server.  So far the only options I've found are to view the data on the console and manually export it to a text file, or to use the archiving feature to export to csv any process logs matching a certain age criteria.  The former is a no-go since it's manual.  The latter could work but it appears to delete the data that's being exported. If the data were consumable via REST, that would be ideal.  Or if there were an option under System to record certain logs in the Windows Application event log a text file at the same time as they're recorded to the database. I've also toyed with spying the Blue Prism console but I noticed a forum post that reported problems there.   For now I will probably just query the database but I try to avoid that in general unless it's explicitly supported by the vendor, and I don't think it is in this case.

[SaurabhSrivasta]

What query have you formed to retrieve the database logs?

[AmiBarrett]

Right. When dealing with anything OOB, your best best probably is to query the BP database directly. The biggest problem with this is that the structure is almost overly relational, so the joins and queries get complex very quickly. An alternative to this, may be to create a separate DB/table just to dump custom logs to. We wrote an API in PHP that BP just feeds JSON data to to store disposition and live status data. Since it's in one table, it's incredibly easy to query and read. Though this solution may only work if you don't need to have a fine amount of granularity in your logs, such as what you'd get from enabling stage logging on all stages of a process/object.

[MichaelWeinstei]

We also have a requirement that logging/audit data has to fed into LogRhythm (via syslog format), the client's logging solution, for active monitoring, auditing, etc.  Currently we are exploring writing custom database scripts to do this, so I would be curious if anyone else has tried to  do this too.  Thanks!