@pandusen, I understand your frustration, but please focus on the content, not the person. Also, note that the request for dmesg output came from @MajorP93. @john.c, if you use a tool, please check its commands before posting, and try to keep your posts shorter. On the content: step 1 of @john.c's advice is xen-cmdline --set-xen "pci=realloc", and that part is wrong. AFAIK, Xen's pci= option only accepts serr, perr and quirks (Xen command line docs); realloc isn't a valid Xen option. pci=realloc is a Linux kernel option, right? It's okay to be wrong; I often am too. The important thing is not to be overly assertive when you're not sure you have the right answer. Teddy's answer is sound, which is why I marked this thread as solved. However, the thread isn't locked, so it remains open for the Arc and ReBAR follow-up. Thanks, folks, let's keep a friendly and helpful atmosphere.

@poddingue Thanks for taking a look on your end as well. I would like to point out that the line from the docs is quite deffinitive. If there are gotchas, such as UEFI affecting things. Then this either should be documented. Or better yet, that outlier of an edge-case probably should be addressed. One scenario I'm envisioning is that a disk is faulty for some reason, and this goes unoticed due to the VM being rarely used. And since no backup-errors are given, this might go unoticed for quite some time. The Health Check passing is a false signal in that case. These are my two-cents. And I confirm that this is an edge-case, and even unlikely one. But a theoretical greater than zero risk anyways. Thank you

For anyone reading along who needs the forwarding part today, the [logs.transport.syslog] setting this PR builds on is documented, though on the backup settings page rather than next to the audit log, which isn't where I'd have looked: https://docs.xen-orchestra.com/backups-and-dr/backup-features-and-settings#send-xo-logs-to-an-external-syslog-server On the design question (a log line through the existing pipeline versus a dedicated syslog transport in the plugin) I don't know the plugin well enough to have an opinion worth reading, so I think it's one for @Team-XO-Backend. The PR has been open since late September without a reviewer, so a look from them would help it along. I'm also curious about your second question: if others here already ship audit records to a SIEM, saying so would show how many people need this.