setup.php

<?php
/*
 +-------------------------------------------------------------------------+
 | Copyright (C) 2004-2026 The Cacti Group                                 |
 |                                                                         |
 | This program is free software; you can redistribute it and/or           |
 | modify it under the terms of the GNU General Public License             |
 | as published by the Free Software Foundation; either version 2          |
 | of the License, or (at your option) any later version.                  |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 +-------------------------------------------------------------------------+
 | Cacti: The Complete RRDTool-based Graphing Solution                     |
 +-------------------------------------------------------------------------+
 | This code is designed, written, and maintained by the Cacti Group. See  |
 | about.php and/or the AUTHORS file for specific developer information.   |
 +-------------------------------------------------------------------------+
 | http://www.cacti.net/                                                   |
 +-------------------------------------------------------------------------+
*/

include_once('audit_functions.php');

function plugin_audit_install() {
	api_plugin_register_hook('audit', 'config_arrays',        'audit_config_arrays',        'setup.php');
	api_plugin_register_hook('audit', 'config_settings',      'audit_config_settings',      'setup.php');
	api_plugin_register_hook('audit', 'config_insert',        'audit_config_insert',        'setup.php');
	api_plugin_register_hook('audit', 'poller_bottom',        'audit_poller_bottom',        'setup.php');
	api_plugin_register_hook('audit', 'draw_navigation_text', 'audit_draw_navigation_text', 'setup.php');
	api_plugin_register_hook('audit', 'utilities_array',      'audit_utilities_array',      'setup.php');
	api_plugin_register_hook('audit', 'is_console_page',      'audit_is_console_page',      'setup.php');
	api_plugin_register_hook('audit', 'logout_pre_session_destroy', 'audit_logout_pre_session_destroy', 'setup.php');

	/* hook for table replication */
	api_plugin_register_hook('audit', 'replicate_out',        'audit_replicate_out',        'setup.php');

	audit_setup_realms(true);

	audit_setup_table();
}

function audit_setup_realms($grant_installing_user = false) {
	$realms = array(
		'audit.php'        => __('Audit Log User', 'audit'),
		'audit_manage.php' => __('Audit Log Admin', 'audit')
	);

	foreach ($realms as $file => $display) {
		api_plugin_register_realm('audit', $file, $display, $grant_installing_user ? 1 : 0);
	}

	if (!$grant_installing_user) {
		$admin_user = (int) read_config_option('admin_user');

		if ($admin_user > 0) {
			$realm_ids = db_fetch_assoc_prepared('SELECT id + 100 AS realm_id
				FROM plugin_realms
				WHERE plugin = ?
				AND file IN (?, ?)',
				array('audit', 'audit.php', 'audit_manage.php'));

			foreach ($realm_ids as $realm) {
				db_execute_prepared('REPLACE INTO user_auth_realm
					(user_id, realm_id)
					VALUES (?, ?)',
					array($admin_user, $realm['realm_id']));
			}
		}
	}
}

function audit_remove_deprecated_realms() {
	$realms = db_fetch_assoc_prepared('SELECT id
		FROM plugin_realms
		WHERE plugin = ?
		AND file = ?',
		array('audit', 'audit_purge.php'));

	foreach ($realms as $realm) {
		$realm_id = $realm['id'] + 100;

		db_execute_prepared('DELETE FROM user_auth_realm
			WHERE realm_id = ?',
			array($realm_id));

		db_execute_prepared('DELETE FROM user_auth_group_realm
			WHERE realm_id = ?',
			array($realm_id));

		db_execute_prepared('DELETE FROM plugin_realms
			WHERE id = ?',
			array($realm['id']));
	}

	if (cacti_sizeof($realms)) {
		api_plugin_replicate_config();
	}
}

function plugin_audit_uninstall() {
	db_execute('DROP TABLE IF EXISTS audit_syslog_delivery');
	db_execute('DROP TABLE IF EXISTS audit_log');
	return true;
}

function audit_is_console_page($url) {
	if (strpos($url, 'audit.php') !== false) {
		return true;
	}

	return false;
}

function plugin_audit_check_config() {
	return true;
}

function plugin_audit_upgrade() {
	return true;
}

function audit_check_upgrade() {
	global $config, $database_default;
	include_once($config['library_path'] . '/database.php');
	include_once($config['library_path'] . '/functions.php');

	$files = array('plugins.php', 'audit.php');
	if (isset($_SERVER['PHP_SELF']) && !in_array(basename($_SERVER['PHP_SELF']), $files)) {
		return;
	}

	$info    = plugin_audit_version();
	$current = $info['version'];
	$old     = db_fetch_cell_prepared('SELECT version FROM plugin_config WHERE directory = ?', array('audit'));
	if ($current != $old) {
		if (api_plugin_is_enabled('audit')) {
			# may sound ridiculous, but enables new hooks
			api_plugin_enable_hooks('audit');
		}

		db_execute('ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS object_data LONGBLOB');
		if (db_column_exists('audit_log', 'outcome')) {
			if (!db_column_exists('audit_log', 'request_status')) {
				db_execute("ALTER TABLE audit_log CHANGE COLUMN outcome request_status varchar(20) NOT NULL DEFAULT 'unknown'");
			} else {
				db_execute("UPDATE audit_log SET request_status = outcome WHERE request_status = 'unknown'");
				db_execute('ALTER TABLE audit_log DROP COLUMN outcome');
			}
		} elseif (!db_column_exists('audit_log', 'request_status')) {
			db_execute("ALTER TABLE audit_log ADD COLUMN request_status varchar(20) NOT NULL DEFAULT 'unknown' AFTER action");
		}

		db_execute("UPDATE audit_log SET request_status = CASE request_status
			WHEN 'attempted' THEN 'started'
			WHEN 'request_completed' THEN 'completed'
			WHEN 'request_failed' THEN 'failed'
			ELSE request_status END");
		db_execute("ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS external_status varchar(20) NOT NULL DEFAULT 'unknown' AFTER object_data");
		db_execute('ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS external_error varchar(1024) DEFAULT NULL AFTER external_status');
		audit_upgrade_event_schema();
		audit_setup_syslog_table();
		audit_setup_realms();
		audit_remove_deprecated_realms();

		db_execute_prepared('UPDATE plugin_config
			SET version = ?
			WHERE directory = ?',
			array($current, 'audit'));

		db_execute_prepared('UPDATE plugin_config SET
			version = ?,
			name = ?,
			author = ?,
			webpage = ?
			WHERE directory = ?',
			array($info['version'], $info['longname'], $info['author'], $info['homepage'], $info['name']));

		/* hook for table replication */
		api_plugin_register_hook('audit', 'replicate_out', 'audit_replicate_out', 'setup.php', '1');
		api_plugin_register_hook('audit', 'is_console_page', 'audit_is_console_page', 'setup.php', 1);
		api_plugin_register_hook('audit', 'logout_pre_session_destroy', 'audit_logout_pre_session_destroy', 'setup.php', 1);
	}
}

function audit_replicate_out($data) {
	$rcnn_id          = $data['rcnn_id'];
	$class            = $data['class'];

	cacti_log('INFO: Replicating for the Audit Plugin', false, 'REPLICATE');

	if ($class == 'all') {
		if (!db_table_exists('audit_log', false, $rcnn_id)) {
			cacti_log('INFO: Audit Log table does not exist creating', false, 'REPLICATE');

			$table  = 'audit_log';
			$create = db_fetch_row("SHOW CREATE TABLE $table");

			if (isset($create["CREATE TABLE `$table`"]) || isset($create['Create Table'])) {
				if (isset($create["CREATE TABLE `$table`"])) {
					db_execute($create["CREATE TABLE `$table`"], true, $rcnn_id);
				} else {
					db_execute($create['Create Table'], true, $rcnn_id);
				}
			}
		} else {
			cacti_log('INFO: Audit Log table exists, checking schema', false, 'REPLICATE');
		}

		db_execute('ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS object_data LONGBLOB', true, $rcnn_id);
		if (db_column_exists('audit_log', 'outcome', false, $rcnn_id)) {
			if (!db_column_exists('audit_log', 'request_status', false, $rcnn_id)) {
				db_execute("ALTER TABLE audit_log CHANGE COLUMN outcome request_status varchar(20) NOT NULL DEFAULT 'unknown'", true, $rcnn_id);
			} else {
				db_execute("UPDATE audit_log SET request_status = outcome WHERE request_status = 'unknown'", true, $rcnn_id);
				db_execute('ALTER TABLE audit_log DROP COLUMN outcome', true, $rcnn_id);
			}
		} elseif (!db_column_exists('audit_log', 'request_status', false, $rcnn_id)) {
			db_execute("ALTER TABLE audit_log ADD COLUMN request_status varchar(20) NOT NULL DEFAULT 'unknown' AFTER action", true, $rcnn_id);
		}

		db_execute("UPDATE audit_log SET request_status = CASE request_status
			WHEN 'attempted' THEN 'started'
			WHEN 'request_completed' THEN 'completed'
			WHEN 'request_failed' THEN 'failed'
			ELSE request_status END", true, $rcnn_id);
		db_execute("ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS external_status varchar(20) NOT NULL DEFAULT 'unknown' AFTER object_data", true, $rcnn_id);
		db_execute('ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS external_error varchar(1024) DEFAULT NULL AFTER external_status', true, $rcnn_id);
		audit_upgrade_event_schema($rcnn_id);
	}

	return $data;
}

function audit_poller_bottom() {
	audit_retry_external_logs();
	audit_process_syslog_queue();

	$last_check = read_config_option('audit_last_check');
	$now        = gmdate('Y-m-d');

	if ($last_check != $now) {
		$retention = read_config_option('audit_retention');

		if ($retention > 0) {
			$cutoff = audit_retention_cutoff($retention);

			db_execute_prepared("DELETE FROM audit_log
				WHERE event_time < ?
				AND NOT EXISTS (
					SELECT 1
					FROM audit_syslog_delivery
					WHERE audit_syslog_delivery.audit_id = audit_log.id
					AND audit_syslog_delivery.state IN ('pending', 'retry', 'dead_letter')
				)",
				array($cutoff->format('Y-m-d H:i:s')));
			$rows = db_affected_rows();
			cacti_log('NOTE: Purged ' . $rows . ' Audit Log Records from Cacti', false, 'POLLER');
		}
	}

	set_config_option('audit_last_check', $now);
}

function audit_setup_table() {
	global $config, $database_default;
	include_once($config['library_path'] . '/database.php');

	db_execute("CREATE TABLE IF NOT EXISTS `audit_log` (
		`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
		`page` varchar(40) DEFAULT NULL,
		`user_id` int(10) unsigned DEFAULT NULL,
		`action` varchar(20) DEFAULT NULL,
		`request_status` varchar(20) NOT NULL DEFAULT 'unknown',
		`ip_address` varchar(40) DEFAULT NULL,
		`user_agent` varchar(256) DEFAULT NULL,
		`event_time` timestamp DEFAULT CURRENT_TIMESTAMP,
		`post` longblob,
		`object_data` longblob,
		`external_status` varchar(20) NOT NULL DEFAULT 'unknown',
		`external_error` varchar(1024) DEFAULT NULL,
		`event_uuid` char(36) DEFAULT NULL,
		`correlation_id` char(36) DEFAULT NULL,
		`event_type` varchar(100) NOT NULL DEFAULT 'cacti.request',
		`event_category` varchar(40) NOT NULL DEFAULT 'configuration',
		`severity` varchar(12) NOT NULL DEFAULT 'info',
		`actor_type` varchar(20) NOT NULL DEFAULT 'user',
		`target_type` varchar(64) DEFAULT NULL,
		`target_id` varchar(128) DEFAULT NULL,
		`operation_outcome` varchar(20) NOT NULL DEFAULT 'unknown',
		`outcome_reason` varchar(255) DEFAULT NULL,
		`http_method` varchar(10) DEFAULT NULL,
		`http_status` smallint unsigned DEFAULT NULL,
		`completed_time` datetime(6) DEFAULT NULL,
		`duration_ms` bigint unsigned DEFAULT NULL,
		`details` longblob,
		`previous_hash` char(64) DEFAULT NULL,
		`integrity_hash` char(64) DEFAULT NULL,
		`external_attempts` int unsigned NOT NULL DEFAULT 0,
		`external_last_attempt` datetime(6) DEFAULT NULL,
		`external_delivered_time` datetime(6) DEFAULT NULL,
		PRIMARY KEY (`id`),
		KEY `user_id` (`user_id`),
		KEY `page` (`page`),
		KEY `ip_address` (`ip_address`),
		KEY `event_time` (`event_time`),
		KEY `action` (`action`),
		UNIQUE KEY `event_uuid` (`event_uuid`),
		KEY `correlation_id` (`correlation_id`),
		KEY `event_type` (`event_type`),
		KEY `operation_outcome` (`operation_outcome`),
		KEY `external_status` (`external_status`))
		ENGINE=InnoDB
		COMMENT='Audit Log for all GUI activities'");

	audit_setup_syslog_table();

	return true;
}

function audit_setup_syslog_table() {
	db_execute("CREATE TABLE IF NOT EXISTS `audit_syslog_delivery` (
		`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
		`audit_id` bigint(20) unsigned NOT NULL,
		`event_uuid` char(36) NOT NULL,
		`destination_fingerprint` char(64) NOT NULL,
		`node_id` varchar(255) NOT NULL,
		`poller_id` varchar(64) DEFAULT NULL,
		`state` varchar(20) NOT NULL DEFAULT 'pending',
		`attempts` int unsigned NOT NULL DEFAULT 0,
		`next_attempt` datetime(6) NOT NULL,
		`last_attempt` datetime(6) DEFAULT NULL,
		`sent_time` datetime(6) DEFAULT NULL,
		`last_error` varchar(1024) DEFAULT NULL,
		`created_time` datetime(6) NOT NULL,
		`updated_time` datetime(6) NOT NULL,
		PRIMARY KEY (`id`),
		UNIQUE KEY `audit_destination` (`audit_id`, `destination_fingerprint`),
		KEY `event_uuid` (`event_uuid`),
		KEY `state_next_attempt` (`state`, `next_attempt`),
		KEY `destination_state` (`destination_fingerprint`, `state`),
		CONSTRAINT `fk_audit_syslog_event`
			FOREIGN KEY (`audit_id`) REFERENCES `audit_log` (`id`)
			ON DELETE CASCADE)
		ENGINE=InnoDB
		COMMENT='Remote Syslog delivery queue for audit events'");

	db_execute("ALTER TABLE audit_syslog_delivery
		ADD COLUMN IF NOT EXISTS node_id varchar(255) NOT NULL DEFAULT 'cacti'
		AFTER destination_fingerprint");
	db_execute("ALTER TABLE audit_syslog_delivery
		ADD COLUMN IF NOT EXISTS poller_id varchar(64) DEFAULT NULL
		AFTER node_id");
}

function audit_upgrade_event_schema($rcnn_id = false) {
	$remote = $rcnn_id !== false;
	$args   = $remote ? array(true, $rcnn_id) : array();
	$columns = array(
		"event_uuid char(36) DEFAULT NULL",
		"correlation_id char(36) DEFAULT NULL",
		"event_type varchar(100) NOT NULL DEFAULT 'cacti.request'",
		"event_category varchar(40) NOT NULL DEFAULT 'configuration'",
		"severity varchar(12) NOT NULL DEFAULT 'info'",
		"actor_type varchar(20) NOT NULL DEFAULT 'user'",
		"target_type varchar(64) DEFAULT NULL",
		"target_id varchar(128) DEFAULT NULL",
		"operation_outcome varchar(20) NOT NULL DEFAULT 'unknown'",
		"outcome_reason varchar(255) DEFAULT NULL",
		"http_method varchar(10) DEFAULT NULL",
		"http_status smallint unsigned DEFAULT NULL",
		"completed_time datetime(6) DEFAULT NULL",
		"duration_ms bigint unsigned DEFAULT NULL",
		"details longblob",
		"previous_hash char(64) DEFAULT NULL",
		"integrity_hash char(64) DEFAULT NULL",
		"external_attempts int unsigned NOT NULL DEFAULT 0",
		"external_last_attempt datetime(6) DEFAULT NULL",
		"external_delivered_time datetime(6) DEFAULT NULL"
	);

	foreach ($columns as $definition) {
		call_user_func_array('db_execute', array_merge(
			array('ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS ' . $definition),
			$args
		));
	}

	$indexes = array(
		'event_uuid' => array('UNIQUE INDEX', array('event_uuid')),
		'correlation_id' => array('INDEX', array('correlation_id')),
		'event_type' => array('INDEX', array('event_type')),
		'operation_outcome' => array('INDEX', array('operation_outcome')),
		'external_status' => array('INDEX', array('external_status'))
	);

	foreach ($indexes as $name => $definition) {
		if (!db_index_exists('audit_log', $name, false, $remote ? $rcnn_id : false)) {
			db_add_index('audit_log', $definition[0], $name, $definition[1], true, $remote ? $rcnn_id : false);
		}
	}
}

function plugin_audit_version() {
	global $config;
	$info = parse_ini_file($config['base_path'] . '/plugins/audit/INFO', true);
	return $info['info'];
}

function audit_log_valid_event() {
	global $action;

	$valid = false;

	if (read_config_option('audit_enabled') == 'on') {
		if (strpos($_SERVER['SCRIPT_NAME'], 'graph_view.php') !== false) {
			$valid = false;
		} elseif (strpos($_SERVER['SCRIPT_NAME'], 'user_admin.php') !== false &&
			isset_request_var('action') && get_nfilter_request_var('action') == 'checkpass') {
			$valid = false;
		} elseif (strpos($_SERVER['SCRIPT_NAME'], 'plugins.php') !== false) {
			if (isset_request_var('mode')) {
				$valid  = true;
				$action = get_nfilter_request_var('mode');
			}
		} elseif (strpos($_SERVER['SCRIPT_NAME'], 'auth_profile.php') !== false) {
			$valid = false;
		} elseif (strpos($_SERVER['SCRIPT_NAME'], 'index.php') !== false) {
			$valid = false;
		} elseif (strpos($_SERVER['SCRIPT_NAME'], 'auth_changepassword.php') !== false) {
			$valid = false;
		} elseif (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST' &&
			cacti_sizeof(filter_input_array(INPUT_POST, FILTER_UNSAFE_RAW))) {
			$valid = true;
		} elseif (isset_request_var('purge_continue')) {
			$valid  = true;
			$action = 'purge';
		}
	}

	return $valid;
}

function audit_utilities_array() {
	global $utilities;

	if (version_compare(CACTI_VERSION, '1.3.0', '<')) {
		if (api_plugin_user_realm_auth('audit.php')) {
			$utilities[__('Technical Support', 'audit')] = array_merge(
				$utilities[__('Technical Support', 'audit')],
				array(
					__('View Audit Log', 'audit') => array(
						'link'  => 'plugins/audit/audit.php',
						'description' => __('Allows Administrators to view change activity on the Cacti server.  Administrators can also export the audit log for analysis purposes.', 'audit')
					)
				)
			);
		}
	}
}

function audit_config_arrays() {
	global $menu, $messages, $audit_retentions, $utilities;

	if (isset($_SESSION['audit_message']) && $_SESSION['audit_message'] != '') {
		$messages['audit_message'] = array('message' => $_SESSION['audit_message'], 'type' => 'info');
	}

	$audit_retentions = array(
		-1   => __('Indefinitely', 'audit'),
		14   => __('%d Weeks',  2, 'audit'),
		30   => __('%d Month',  1, 'audit'),
		60   => __('%d Months', 2, 'audit'),
		90   => __('%d Months', 3, 'audit'),
		120  => __('%d Months', 4, 'audit'),
		183  => __('%d Months', 6, 'audit'),
		365  => __('%d Year',   1, 'audit'),
		730  => __('%d Years',  2, 'audit'),
		1095 => __('%d Years',  3, 'audit')
	);

	$menu[__('Utilities')]['plugins/audit/audit.php'] = __('Audit Log', 'audit');

	if (function_exists('auth_augment_roles')) {
		auth_augment_roles(__('Audit Plugin', 'audit'), array('audit.php', 'audit_manage.php'));
	}

	audit_check_upgrade();
}

function audit_config_settings() {
	global $tabs, $settings, $item_rows, $audit_retentions;

	$temp = array(
		'audit_header' => array(
			'friendly_name' => __('Audit Log Settings', 'audit'),
			'method' => 'spacer',
		),
		'audit_enabled' => array(
			'friendly_name' => __('Enable Audit Log', 'audit'),
			'description' => __('Check this box, if you want the Audit Log to track GUI activities.', 'audit'),
			'method' => 'checkbox',
			'default' => 'on'
		),
		'audit_retention' => array(
			'friendly_name' => __('Audit Log Retention', 'audit'),
			'description' => __('How long do you wish Audit Log entries to be retained?', 'audit'),
			'method' => 'drop_array',
			'default' => '90',
			'array' => $audit_retentions
		),
		'audit_log_external' => array(
			'friendly_name' => __('External Audit Log', 'audit'),
			'description' => __('Check this box, if you want the Audit Log to be written to an external file.', 'audit'),
			'method' => 'checkbox',
			'default' => 'off'
		),
		'audit_log_external_format' => array(
			'friendly_name' => __('External Audit Log Format', 'audit'),
			'description' => __('Select the output format for external audit log records.', 'audit'),
			'method' => 'drop_array',
			'default' => 'json',
			'array' => array(
				'text' => __('Text', 'audit'),
				'json' => __('JSON', 'audit')
			)
		),
		'audit_log_external_path' => array(
			'friendly_name' => __('External Audit Log Log file  Path', 'audit'),
			'description' => __('Enter the path to the external audit log file.', 'audit'),
			'method' => 'filepath',
			'default' => '/var/www/html/cacti/log/audit.log',
			'max_length' => '255'
		),
	);

	if (php_sapi_name() === 'cli' || audit_user_is_admin()) {
		$facility_options = array();
		foreach (audit_syslog_facilities() as $facility => $code) {
			$facility_options[$facility] = strtoupper($facility) . ' (' . $code . ')';
		}

		$syslog = array(
			'audit_syslog_header' => array(
				'friendly_name' => __('Remote Syslog', 'audit'),
				'method' => 'spacer'
			),
			'audit_syslog_enabled' => array(
				'friendly_name' => __('Enable Remote Syslog', 'audit'),
				'description' => __('Queue finalized audit events for remote Syslog delivery. The existing external file output remains independent.', 'audit'),
				'method' => 'checkbox',
				'default' => 'off'
			),
			'audit_syslog_receiver' => array(
				'friendly_name' => __('Syslog Receiver', 'audit'),
				'description' => __('Enter a receiver hostname or IP address without a URI scheme, path, or credentials.', 'audit'),
				'method' => 'textbox',
				'default' => '',
				'max_length' => '253',
				'size' => '60'
			),
			'audit_syslog_port' => array(
				'friendly_name' => __('Syslog Port', 'audit'),
				'description' => __('Enter 1-65535, or leave blank to use 514 for UDP/TCP and 6514 for TLS.', 'audit'),
				'method' => 'textbox',
				'default' => '',
				'max_length' => '5',
				'size' => '8'
			),
			'audit_syslog_transport' => array(
				'friendly_name' => __('Syslog Transport', 'audit'),
				'description' => __('UDP sends one datagram without acknowledgement. TCP and TLS use RFC 6587 octet-count framing.', 'audit'),
				'method' => 'drop_array',
				'default' => 'udp',
				'array' => array(
					'udp' => __('UDP', 'audit'),
					'tcp' => __('TCP', 'audit'),
					'tls' => __('TLS', 'audit')
				)
			),
			'audit_syslog_format' => array(
				'friendly_name' => __('Syslog Payload Format', 'audit'),
				'description' => __('All formats use an RFC 5424 header. Select RFC 5424 structured data, CEF, or compact JSON for the message.', 'audit'),
				'method' => 'drop_array',
				'default' => 'json',
				'array' => array(
					'rfc5424' => __('RFC 5424', 'audit'),
					'cef' => __('CEF', 'audit'),
					'json' => __('JSON', 'audit')
				)
			),
			'audit_syslog_facility' => array(
				'friendly_name' => __('Syslog Facility', 'audit'),
				'description' => __('Select the facility used to calculate the RFC 5424 priority.', 'audit'),
				'method' => 'drop_array',
				'default' => 'local0',
				'array' => $facility_options
			),
			'audit_syslog_application' => array(
				'friendly_name' => __('Syslog Application Name', 'audit'),
				'description' => __('RFC 5424 APP-NAME. Printable non-space ASCII, up to 48 characters.', 'audit'),
				'method' => 'textbox',
				'default' => 'cacti-audit',
				'max_length' => '48',
				'size' => '30'
			),
			'audit_syslog_node_id' => array(
				'friendly_name' => __('Audit Node Identity', 'audit'),
				'description' => __('Stable RFC 5424 hostname identity for this Cacti node. Do not use a value that changes on restart.', 'audit'),
				'method' => 'textbox',
				'default' => php_uname('n'),
				'max_length' => '255',
				'size' => '60'
			),
			'audit_syslog_timeout' => array(
				'friendly_name' => __('Connection and Write Timeout', 'audit'),
				'description' => __('Timeout in seconds, from 1 through 30.', 'audit'),
				'method' => 'textbox',
				'default' => '5',
				'max_length' => '2',
				'size' => '8'
			),
			'audit_syslog_udp_max_size' => array(
				'friendly_name' => __('Maximum UDP Record Size', 'audit'),
				'description' => __('Records larger than this byte limit are dead-lettered and are never truncated or split. TCP or TLS is recommended for large events.', 'audit'),
				'method' => 'textbox',
				'default' => '8192',
				'max_length' => '5',
				'size' => '10'
			),
			'audit_syslog_tls_header' => array(
				'friendly_name' => __('Syslog TLS', 'audit'),
				'method' => 'spacer'
			),
			'audit_syslog_tls_ca_file' => array(
				'friendly_name' => __('TLS CA File', 'audit'),
				'description' => __('Optional PEM CA bundle. Peer and hostname verification are always enabled.', 'audit'),
				'method' => 'filepath',
				'default' => '',
				'max_length' => '255'
			),
			'audit_syslog_tls_client_cert' => array(
				'friendly_name' => __('TLS Client Certificate', 'audit'),
				'description' => __('Optional PEM client certificate. A client key must also be configured.', 'audit'),
				'method' => 'filepath',
				'default' => '',
				'max_length' => '255'
			),
			'audit_syslog_tls_client_key' => array(
				'friendly_name' => __('TLS Client Private Key', 'audit'),
				'description' => __('Optional readable PEM private-key path. The key contents are never stored in audit events.', 'audit'),
				'method' => 'filepath',
				'default' => '',
				'max_length' => '255'
			),
			'audit_syslog_delivery_header' => array(
				'friendly_name' => __('Syslog Delivery Queue', 'audit'),
				'method' => 'spacer'
			),
			'audit_syslog_retry_base' => array(
				'friendly_name' => __('Retry Base Delay', 'audit'),
				'description' => __('Initial retry delay in seconds, from 1 through 3600.', 'audit'),
				'method' => 'textbox',
				'default' => '30',
				'max_length' => '4',
				'size' => '8'
			),
			'audit_syslog_retry_max' => array(
				'friendly_name' => __('Maximum Retry Delay', 'audit'),
				'description' => __('Maximum retry delay in seconds, from the base delay through 86400.', 'audit'),
				'method' => 'textbox',
				'default' => '3600',
				'max_length' => '5',
				'size' => '8'
			),
			'audit_syslog_max_attempts' => array(
				'friendly_name' => __('Maximum Delivery Attempts', 'audit'),
				'description' => __('Move a record to dead-letter after this many attempts, from 1 through 100.', 'audit'),
				'method' => 'textbox',
				'default' => '10',
				'max_length' => '3',
				'size' => '8'
			),
			'audit_syslog_batch_size' => array(
				'friendly_name' => __('Poller Batch Size', 'audit'),
				'description' => __('Maximum due records processed per poller cycle, from 1 through 1000.', 'audit'),
				'method' => 'textbox',
				'default' => '100',
				'max_length' => '4',
				'size' => '8'
			),
			'audit_syslog_pending_age_warning' => array(
				'friendly_name' => __('Pending Age Warning', 'audit'),
				'description' => __('Show an unhealthy warning when the oldest queued record reaches this age in seconds.', 'audit'),
				'method' => 'textbox',
				'default' => '900',
				'max_length' => '6',
				'size' => '10'
			),
			'audit_syslog_dead_letter_warning' => array(
				'friendly_name' => __('Dead-letter Warning Count', 'audit'),
				'description' => __('Show an unhealthy warning when this many records are dead-lettered.', 'audit'),
				'method' => 'textbox',
				'default' => '1',
				'max_length' => '7',
				'size' => '10'
			)
		);

		$temp = array_merge($temp, $syslog);
	}

	$tabs['audit'] = __('Audit', 'audit');

	if (isset($settings['audit'])) {
		$settings['audit'] = array_merge($settings['audit'], $temp);
	} else {
		$settings['audit'] = $temp;
	}
}

function audit_draw_navigation_text($nav) {
	$nav['audit.php:'] = array(
		'title'   => __('Audit Event Log', 'audit'),
		'mapping' => 'index.php:',
		'url'     => 'audit.php',
		'level'   => '1'
	);

	return $nav;
}