System logging protocol (syslog) audit logs

Various components in GDC produce their audit logs using a standard syslog format according to the RFC-5424 specification. For more information, see https://datatracker.ietf.org/doc/html/rfc5424.

JSON representation

{
  "pid": string,
  "pri": string,
  "hostname": string,
  "ident": string,
  "msgid": string,
  "extradata": string,
  "message": string
}

Fields
pid	string The process ID of the application that originated the message. For example, "1"
pri	string Priority value. For example, "46"
hostname	string The component that originally sent the syslog message. For example, "anthos-audit-logs-forwarder-2kbnd"
ident	string The device or application that originated the message. For example, "/logging-prober-sidecar"
msgid	string The type of message. For example, "audit-log"
extradata	string Additional custom information. For example, "[exampleSDID@20224 iut=\"3\" eventSource=\"Application\" eventID=\"11211\"]"
message	string A free-form message that provides information about the event. For example, "{\"time\":\"2024-01-24T17:24:55.076954537Z\",\"auditID\":\"7ab3bf57-67cb-4373-bbf6-b3ad0835cc65\",\"user\":{\"identity\":\"audit-log-writer\"},\"resource\":\"41075\",\"action\":\"-\",\"description\":\"This is a prober testing the functionality of the syslog endpoint\",\"userAgent\":\"audit-log-prober\",\"response\":\"-\",\"_gdch_org\":\"-\",\"_gdch_service\":\"audit-log-prober\"}"