SysLog publishing - what authentication methods available

[ccastbr]

I have set up SysLog publishing to a logstash server and it is working fine.  The logstash server has a certificate issued by our certificate authority and I imported the root certificate and intermediate certificate to the ePO Windows VM. 

I was asked, and I do not know how to answer, what authentication methods are available for the ePO in connecting to the syslog server.   I was asked if the ePO can specify different levels of SSL authentication (ex: Anonymous, Certificate, Name, Fingerprint).      I am not sure I can answer what method is being used.    

I have read KB87927 and also forwarded that to the syslog server owner, but they are still curious, and, now, so am I!   

Does anyone know more about how authentication from the ePO to the syslog server is handled and whether there is a way to configure what method is used?

Thanks

[cdinet · Accepted solution]

Per KB91194, ePO syslog integration is only supported for TCP with TLS receivers following RFC 5424 and RFC 5425 (generally known as syslog-ng).  There is no place for any credentials, it is strictly a tls connection based on the certificate you imported.  So basically, it is all based on the RFC standards.  That is all the info we have on it, to be honest.  It would take an SR and case opened with development to get any other detail.

[ccastbr]

Thank you.  I will pass the information along.   Syslog is working as expected, however, I just had that lingering question.