Audit Logging

To use audit logging, perform the following procedure:

1. Launch In-Sight Vision Suite if it is not already running.

2. Left-click the device you want to configure on the In-Sight® Device Pane on the left. The list of Utilities applicable to the selected vision system then appears at the bottom of the window.

   

3. Click Audit Logging.

   The Audit Logging window appears.

4. Retrieve the audit log by doing one of the following:

   1. Download the audit log by clicking Download Log.

      

   2. Click Enable Syslog Forwarding to enable sending the audit log to a remote server.

      

      After setting up the IP address and the port number, open the TCP Framing dropdown and select the TCP framing option to use:

      • Octet-Counted (default): each message is prefixed with its length in bytes, followed by the message. Preferred for Linux-based syslog servers.

      • Traditional: messages are delimited by a newline character (\n). Preferred for Windows-based syslog servers.

      Note: In-Sight Vision Suite uses syslog forwarding protocol to store audit log records. You need to set up a syslog server for collecting audit records.

5. Click OK.

To receive audit messages from your In-Sight vision system in a Windows application, perform the following procedure:

1. Download and install a Windows-based syslog server, such as Syslog Watcher.

2. Start the Syslog Watcher application with Windows administrator privileges.

3. Open the Syslog Watcher Manager, and go to Configure > Network Interfaces > Add TLS Interface.

   

4. A new TLS interface appears in the list of network interfaces. Set the Syslog port for the TLS interface to the same port that you configured for audit log forwarding on your In-Sight vision system.

5. Open the TLS Options dropdown, and set Minimum Protocol Version to TLS 1.2.

6. Click Apply.

7. A pop-up dialog appears stating that a TLS certificate is required, and provides the option to generate a self-signed certificate. Click Yes to open the dialog for generating the certificate.

   

8. Enter the name of your computer in the Common Name (CN) field, and click Generate.

9. Click Start Server on the main screen.

10. Verify that you can now see incoming messages in the View: Latest tab when you perform logged actions on your In-Sight vision system.

1. Download and install Fluentd for Windows.

2. Open the Audit Logging utility in the In-Sight Vision Suite. Perform the following:

   1. Check the Enable Forwarding checkbox.

   2. Set the IP address to the IP address of the host computer.

   3. Select a Port Number.

3. Create the following files on the host computer according to the Fluentd instructions:

   • fluentd.conf

   • fluentd.key

   • fluentd.crt

4. Include the following settings in the fluentd.conf file and modify the port number and pathways to the location where you placed these files on your computer:

   Copy

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   <source>
    @type syslog
    port XXXX
    tag system
    frame_type octet_count
    <transport tls>
     ca_cert_path PATH\TO\YOUR\fluentd.crt
     ca_private_key_path PATH\TO\YOUR\fluentd.key
    </transport>
    <parse>
     @type syslog
     with_priority true
     time_format 1 %Y-%m-%dT%H:%M:%S.%N%:z
     message_format rfc5424
    </parse>
   </source>
   
   <match system.**>
    @type stdout
   </match>
   

5. Select the same port as the Audit Logging utility in In-Sight Vision Suite.

6. Save the changes.

7. Open the Fluent Package Command Prompt. Run the following command, replacing the file pathway:

   Copy

   fluentd -c PATH\TO\YOUR\fluentd.conf

The audit log messages now appear in the Fluent Package Command Prompt. To terminate the connection, press Ctrl+C.