Struct AuditConfig 

pub struct AuditConfig {
    pub enabled: bool,
    pub log_path: String,
    pub signed: bool,
    pub rotation_policy: RotationPolicy,
    pub max_file_size: u64,
    pub retention_count: u32,
    pub log_to_db: bool,
    pub overflow_policy: OverflowPolicy,
    pub max_rows: Option<u64>,
    pub alarm_threshold: u32,
    pub alarm_action: String,
    pub auditable_events: Vec<String>,
}

[audit] section — audit trail configuration.

[audit]
enabled = true
log_path = "/var/log/kipuka/audit.log"
signed = true
rotation_policy = "daily"
overflow_policy = "halt"
max_rows = 1000000

Fields

enabled: bool

Enable audit logging. Default: true.

log_path: String

Path to the audit log file.

When using database-backed audit (log_to_db = true), this path is used for the file-based backup copy.

signed: bool

Enable cryptographic signing of audit log entries.

When true, each audit entry includes an RFC 3161-style timestamp signature chain for tamper detection.

rotation_policy: RotationPolicy

Log rotation policy.

max_file_size: u64

Maximum rotation file size in bytes (when rotation_policy = "size"). Default: 100 MiB.

retention_count: u32

Number of rotated log files to retain. Default: 10.

log_to_db: bool

Store audit events in the database in addition to the log file.

overflow_policy: OverflowPolicy

Overflow policy when audit storage is full (FAU_STG.4).

max_rows: Option<u64>

Maximum number of audit rows in the database.

When this limit is reached, the overflow_policy determines whether old rows are dropped or EST operations are halted. None means no limit (rely on disk space monitoring).

alarm_threshold: u32

Number of consecutive security violations before the alarm action fires (FAU_ARP.1).

Default: 10.

alarm_action: String

Action taken when the alarm threshold is reached.

• "syslog" — emit a syslog alert.
• "halt" — halt EST operations.

Default: "syslog".

auditable_events: Vec<String>

NIAP CA PP FAU_GEN.1: list of auditable event types.

When non-empty, only these event types are recorded. When empty (default), all events are audited.

Implementations

impl AuditConfig

pub fn validate(&self) -> Result<(), String>

Validate audit configuration constraints.

Trait Implementations

impl Clone for AuditConfig

fn clone(&self) -> AuditConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuditConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuditConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.