--output option with
audit-log queries to log the resulting data to a server.
The receiving server can be specified in one of the following formats:
PROTOCOL defaults to TCP,
PORT defaults to 601.
PROTOCOL values are as follows:
TCP protocol is recommended because Incydr's logging messages will often be larger than the max size for UDP protocol. Using UDP protocol may result in data being truncated.
The following command will send the file-events from the past 5 days to the 601 port at the
syslog.example.com server via TCP protocol.
incydr file-events search --start P5D --output syslog.example.com
Specifying all values for the
output option would look as follows: