1. Edit <pf_install>/pingfederate/server/default/conf/log4j2.xml.
  2. Uncomment one of the preset appender configurations:
    • OutboundProvisionerEventToCEFSyslog (a Socket appender under the Outbound provisioner audit log : CEF Formatted syslog appender section)
      Note:

      This Socket appender is followed by two related appenders: PingFailover and RollingFile. Together, they create a running provisioner-audit-cef-syslog-failover.log file in the log directory in the event that CEF logging fails for any reason. Both appenders must also be enabled (uncommented).

    • OutboundProvisionerEventToCEFFile (a RollingFile appender under the Outbound provisioner audit log for CEFFile section)
    Tip:

    Review inline comments and notes in the log4j2.xml file for more information about each appender.

  3. If you are configuring the OutboundProvisionerEventToCEFSyslog Socket appender, replace the placeholder parameter values for the syslog host.
  4. If you are configuring the OutboundProvisionerEventToCEFSyslog Socket appender, uncomment the PingFailover appender reference (<appender-ref ref="OutboundProvisionerEventToCEFSyslog-FAILOVER"/>) from the ProvisionerAuditLogger Logger elements located under the Set up the Outbound provisioner audit logger section.
    Important:

    As indicated in the IMPORTANT comments for the loggers, you must also remove some of the existing appender references.