audit

audit

Description

These options control the handling of audit trails in Zorp.

Audit options

config.audit.compress

Enable the compression of audit trail files. The level of compression can be set via the config.audit.compress_level parameter. Default value: TRUE

config.audit.compress_level

The level of compression ranging from 1 (lowest, default) to 9 (highest). Please note that higher compression levels use significantly more CPU, therefore it is usually not recommended to set it to higher than 4. Default value: 1

config.audit.encrypt

Encrypt the audit trail files using the key provided in the config.audit.encrypt_certificate parameter. Default value: FALSE

config.audit.encrypt_certificate

The X.509 PEM certificate used to encrypt the audit trail files. Default value: empty.

The certificate should be placed in the following format:

-----BEGIN CERTIFICATE-----
insert key here
-----END CERTIFICATE-----

config.audit.encrypt_certificate_file

Name and path of the file containing the X.509 PEM certificate used to encrypt the audit trail files. If this parameter is set, it overrides the settings of config.audit.encrypt_certificate. Default value: empty.

config.audit.reopen_size_threshold

The maximum size of a single audit trail file in bytes. Default value: 2000000000L (2 GB)

config.audit.per_session

Store each session in its own audit file. Default value: FALSE

config.audit.reopen_time_threshold

The maximum time frame of a single audit file in seconds. Default value: 28800 (8 hours)

config.audit.rate_limit

Zorp considers it abnormal if the size of an audit trail is increasing faster than this value in byte/second. Default value: 2097152 (2 MB)

config.audit.rate_notification_interval

Time in seconds before repeating the notification about abnormally growing audit trails. Default value: 300 (5 minutes)

config.audit.write_size_max

Maximum size of an audit trail file in bytes. Default value: 52428800 (50 MB)

config.audit.terminate_on_max_size

If set to TRUE, Zorp terminates the connection if the corresponding audit trail file reaches the size limit set in config.audit.write_size_max. Default value: FALSE