---
title: "Hypr Audit Trail and Hypr App Audit Trail"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/hypr-audit-trail/"
last_modified: "2026-08-02T12:13:35+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Hypr Audit Trail and Hypr App Audit Trail

AxoSyslog can fetch events from the [Hypr REST API](https://apidocs.hypr.com/) using the `hypr-audit-trail()` and `hypr-app-audit-trail()` source drivers.

- `hypr-audit-trail()`: is a source driver that pulls messages from the Hypr API, associated to any RP Application ID.
- `hypr-app-audit-trail()`: is a source driver that pulls messages from the Hypr API, but only those associated to a specific RP Application ID.

## Prerequisites

- AxoSyslog version 4.2.0 or later.
- Install the `axosyslog-scl` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md). On [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md), the SCL files are part of the `axosyslog` base package.

  Your configuration must also contain `@include "scl.conf"`, which the default configuration file already does. If the SCL files are missing, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

  ```shell
  @include "scl.conf"
  ```
- This feature requires a separate module. Install the `axosyslog-mod-python` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md), or the `axosyslog-python` package on [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md). If the module isn’t installed, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

## Hypr Audit Trail

The `hypr-audit-trail()` source queries the Hypr API for the list of potential applications at startup, then monitors the audit trail for each of the detected applications.

> Note: Applications that are registered after `syslog-ng` is started are not recognized.

To start following those audit trails, you must restart `syslog-ng`.

Example minimal configuration:

```shell
source s_hypr {
    hypr-audit-trail(
        url('https://<custom domain>.hypr.com')
        bearer-token('<base64 encoded bearer token>')
    );
};
```

A more detailed example:

```shell
source s_hypr {
    hypr-audit-trail(
        url('https://<custom domain>.hypr.com')
        bearer-token('<base64 encoded bearer token>')
        page-size(<number of results to return in a single page>)
        initial-hours(<number of hours to search backward on initial fetch>)
        application-skip-list('HYPRDefaultApplication', 'HYPRDefaultWorkstationApplication')
        log-level('INFO')
        flags(<optional flags passed to the source>)
        ignore-persistence(<yes/no>)
    );
};
```

Available options:

- `url()`: custom URL for Hypr API access (`'https://<custom domain>.hypr.com'`)
- `bearer-token()`: base64 encoded authentication token from Hypr
- `page-size()`: number of results to return in a single page (optional - defaults to `100`)
- `initial-hours()`: number of hours to search backward on initial fetch (optional - defaults to `4`)
- `application-skip-list()`: list of rpAppIds not to retrieve from Hypr (optional - defaults to `'HYPRDefaultApplication', 'HYPRDefaultWorkstationApplication'`)
- `log-level()`: logging level, possible values: `"DEBUG"`, `"INFO"`, `"WARNING"`, `"ERROR"`, `"CRITICAL"` (optional - defaults to `"INFO"`)
- `flags()`: flags passed to the source, can be used for example to disable message parsing with `flags(no-parse)` (optional - defaults to empty)
- `ignore-persistence()`: ignores the saved value in the persist file, and starts querying from the current time (optional - defaults to no)

## Hypr App Audit Trail

The `hypr-app-audit-trail()` monitors the audit trail for one specific RP Application ID. This driver requires the `rp-app-id()` parameter in order to operate.

Available options:

- `url()`: custom URL for Hypr API access (`'https://<custom domain>.hypr.com'`)
- `bearer-token()`: base64 encoded authentication token from Hypr
- `rp-app-id()`: the RP Application ID for the application to monitor
- `page-size()`: number of results to return in a single page (optional - defaults to `100`)
- `initial-hours()`: number of hours to search backward on initial fetch (optional - defaults to `4`)
- `log-level()`: logging level, possible values: `"DEBUG"`, `"INFO"`, `"WARNING"`, `"ERROR"`, `"CRITICAL"` (optional - defaults to `"INFO"`)
- `flags()`: flags passed to the source, can be used for example to disable message parsing with `flags(no-parse)` (optional - defaults to empty)
- `ignore-persistence()`: ignores the saved value in the persist file, and starts querying from the current time (optional - defaults to `no`)

## Acknowledgements

This documentation page is based on the README file of the `hypr-audit-trail()` source, written by Dan Elder.

Last modified August 2, 2026: [Adds required packages to sources (04b3e715)](https://github.com/axoflow/axosyslog-core-docs/commit/04b3e715e8025d4e9b9f963b485ce6996f113c79)