@john.c Oh, that is most certainly an AI response.. No wonder I was frustrated with the questions. Why do you feel obligated to infuse this slop into a thread on a support forum, with no regard of it being helpful or not?

@poddingue Thanks for taking a look on your end as well. I would like to point out that the line from the docs is quite deffinitive. If there are gotchas, such as UEFI affecting things. Then this either should be documented. Or better yet, that outlier of an edge-case probably should be addressed. One scenario I'm envisioning is that a disk is faulty for some reason, and this goes unoticed due to the VM being rarely used. And since no backup-errors are given, this might go unoticed for quite some time. The Health Check passing is a false signal in that case. These are my two-cents. And I confirm that this is an edge-case, and even unlikely one. But a theoretical greater than zero risk anyways. Thank you

For anyone reading along who needs the forwarding part today, the [logs.transport.syslog] setting this PR builds on is documented, though on the backup settings page rather than next to the audit log, which isn't where I'd have looked: https://docs.xen-orchestra.com/backups-and-dr/backup-features-and-settings#send-xo-logs-to-an-external-syslog-server On the design question (a log line through the existing pipeline versus a dedicated syslog transport in the plugin) I don't know the plugin well enough to have an opinion worth reading, so I think it's one for @Team-XO-Backend. The PR has been open since late September without a reviewer, so a look from them would help it along. I'm also curious about your second question: if others here already ship audit records to a SIEM, saying so would show how many people need this.