The daily edition.

Scope: Rocket Enterprise Developer 12.0 for Eclipse on Linux/UNIX; Enterprise Server security auditing.

Enterprise Server can generate audit records for events such as authentication attempts and resource-access requests, then deliver them as syslog messages to a SIEM. Syslog transport can use unencrypted TCP or encrypted TLS. Rocket still supports the older Audit Manager, but marks it deprecated; syslog is the current mechanism. Enterprise Server Auditing

Three elements must be operational before ESF auditing works:

1. A syslog receiver must listen on a designated port.
2. The relevant security configuration—MFDS, ESCWA, or an Enterprise Server region—must have Create audit events enabled for its External Security Manager.
3. $COBDIR/bin/audit.cfg must direct the audit process to the syslog receiver.

The ordering matters. Rocket explicitly states that audit.cfg must be created and configured first; otherwise, enabling audit-event generation causes auditing to fail and the security manager not to initialize. For a region using the Default ESM, the checkbox is under Default ES Security. For a region-specific ESM, it is under that region’s Security configuration. Configuring Enterprise Server Auditing

A documented configuration structure is:

[audit]
emitter=syslog

[syslog]
hostname=syslog-host
port=syslog-port
protocol=TLS
maxRetryTime=1

hostname may be a host name, IPv4 address, or IPv6 notation. With TLS, additional settings can identify the CA root, client certificate and key, server-certificate verification behavior, and expected certificate hostname. maxRetryTime controls how long retransmission is attempted after a failure; negative values mean an infinite timeout and the default is one second. Configuration changes are not dynamically reloaded—the audit process must be restarted after modifying audit.cfg. Configuring Enterprise Server Auditing

The critical operational nuance concerns receiver placement. When Enterprise Server sends directly to a remote syslog receiver and connectivity fails, retransmission can cause unacceptable performance degradation for as long as delivery remains unavailable. Rocket’s documented mitigation is a local syslog daemon on the Enterprise Server machine. Enterprise Server delivers locally; the daemon can write to a file, forward to external SIEM systems, or do both, while queueing messages during network disruption. Syslog Auditing Performance

Takeaway: Configure ESF auditing as a complete chain—ESM event generation, valid audit.cfg, and preferably a local syslog receiver—because a remote collector outage can otherwise affect application performance.