qumulo_audit_syslog (Resource)¶

Manages syslog audit log configuration on a Qumulo cluster.

This is a singleton resource (one per cluster). It configures the syslog audit logging settings for sending audit events to a remote syslog server.

~> Note: This resource manages a singleton configuration. Deleting this resource resets the syslog audit configuration to disabled state rather than removing it.

Example Usage¶

Installation¶

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic Syslog Configuration¶

resource "qumulo_audit_syslog" "main" {
  connection_profile = "prod"

  enabled        = true
  server_address = "syslog.example.com"
  server_port    = 514
  format         = "json"
}

Syslog with Local Logging¶

resource "qumulo_audit_syslog" "main" {
  connection_profile = "prod"

  enabled        = true
  server_address = "syslog.example.com"
  server_port    = 1514
  format         = "csv"
  local_enabled  = true
}

Multi-Cluster with for_each¶

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_audit_syslog" "all" {
  for_each = var.clusters

  connection_profile = each.value

  enabled        = true
  server_address = var.syslog_server
  format         = "json"
}

Import¶

using the connection profile name (singleton resource):

terraform import qumulo_audit_syslog.main prod

Schema¶

Required¶

connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- enabled (Boolean) Enable remote syslog audit logging.

Optional¶

format (String) Output format for syslog messages. Valid values are 'csv' or 'json'. Defaults to 'json'.
local_enabled (Boolean) Enable per-node local audit logging. Defaults to false.
server_address (String) The IP address, hostname, or FQDN of the remote syslog server. Required when enabled is true.
server_port (Number) The port of the remote syslog server. Defaults to 514.

Read-Only¶

connection_status (String) Current connection status of the audit logger. Possible values: AUDIT_LOG_CONNECTED, AUDIT_LOG_CONNECTING, AUDIT_LOG_DISABLED, AUDIT_LOG_DISCONNECTED.
error_details (String) Detailed error information if the audit logger is disconnected.
error_message (String) Error message if the audit logger is disconnected.