log #3263

New issue

Open

opened 2026-03-14 06:59:45 +03:00 by kerem · 3 comments

kerem commented

2026-03-14 06:59:45 +03:00

Owner

Originally created by @redanthrax on GitHub (Jan 21, 2025).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2122

Originally assigned to: @wh1te909 on GitHub.

Is your feature request related to a problem? Please describe.
I need a way to scrape the audit log and store it externally.

Describe the solution you'd like
I would like the tacticalrmm audit log to log to a file in or a directory in /var/log and end with a .log extension.

Describe alternatives you've considered
Scheduling a script to pull the audit log data from the db and place the data in /var/log.

Additional context
The purpose is to scrape the data with promtail.

Originally created by @redanthrax on GitHub (Jan 21, 2025). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2122 Originally assigned to: @wh1te909 on GitHub. **Is your feature request related to a problem? Please describe.** I need a way to scrape the audit log and store it externally. **Describe the solution you'd like** I would like the tacticalrmm audit log to log to a file in or a directory in /var/log and end with a .log extension. **Describe alternatives you've considered** Scheduling a script to pull the audit log data from the db and place the data in /var/log. **Additional context** The purpose is to scrape the data with promtail.

kerem added the

enhancement

label

2026-03-14 06:59:45 +03:00

kerem commented

2026-03-14 06:59:55 +03:00

Author

Owner

@wulfsystems commented on GitHub (Jul 23, 2025):

from my POV its an important featurerequest.
I for example want to check the tactical logs by splunk.

@wulfsystems commented on GitHub (Jul 23, 2025): from my POV its an important featurerequest. I for example want to check the tactical logs by splunk.

kerem commented

2026-03-14 07:00:00 +03:00

Author

Owner

@eastedentech commented on GitHub (Jan 20, 2026):

Yeah, I would like to push those logs to something like Wazuh or similar.

Or just be able to add a syslog destination so TRMM can just send the logs direct to a syslog ingestion point.

@eastedentech commented on GitHub (Jan 20, 2026): Yeah, I would like to push those logs to something like Wazuh or similar. Or just be able to add a syslog destination so TRMM can just send the logs direct to a syslog ingestion point.

kerem commented

2026-03-14 07:00:06 +03:00

Author

Owner

@bensen1 commented on GitHub (Jan 26, 2026):

Would be highly appreciated by us too! ; )

@bensen1 commented on GitHub (Jan 26, 2026): Would be highly appreciated by us too! ; )