HPE Morpheus Enterprise writes its audit trail through two separate internal loggers, and you need both of them. What follows is the config we run to produce those logs and forward them to a SIEM as CEF over syslog, with no plugin, no scheduled job and no API polling involved. Tested on Morpheus 9.0.x and 8.1.x, RHEL 8, forwarding into QRadar. Know which logger writes what The documented CEF export gets you a working audit feed with this logger: <logger name= "c...