Duo Windows Authentication client log forwarding

[avs1]

Could Dou Windows Authentication client be configured to forward it’s logs to a syslog server?

[DuoKristina]

We don’t have a way to natively forward the Duo for Windows Logon log file output to a syslog server today. You may be able to configure a third-party Windows syslog agent to forward the Duo log. Here’s how to configure one such agent (RSyslog Windows Agent) to accomplish this.

Out of curiosity, would you find it more useful if Duo Authentication for Windows Logon retained use of a text log and had a log forwarding option, or if log output went into the Windows Event Viewer where any syslog agent could grab it?

[avs1]

It would suffice if Duo authentication client would right authentication transactions into Windows Event Viewer.

[DuoKristina]

Thanks for the information.

[tonym1216]

I would like to see some sort of log forwarding also. We use LogRhythm so either Syslog or Windows Event log would work. We got dinged in an audit.

thanks
Tony

[lfulton]

Add us to the list of people needing/wanting the logs to be sent to syslog so they can be ingested in any modern day log collector (not just splunk)

Thanks!
-Lora

[moconnor1]

Same Here. This product definitely needs better SIEM integration

[DuoKristina]

@moconnor Please reach out to your Duo account executive or Customer Success manager, or to Duo Support. They can assist with submitting this as a feature request for you. Comments in this public community forum aren’t tracked as feature requests nor do they “upvote” an idea.