1) set following configuration of audit-log: <audit-log> <formatters> <json-formatter name= "json-formatter" /> </formatters> <handlers> <file-handler name= "file" formatter= "json-formatter" path= "audit-log.log" relative-to= "jboss.server.data.dir" /> <syslog-handler name= "audit-test-syslog-handler" formatter= "json-formatter" syslog-format= "RFC5424" > <tcp host= "127.0.0.1" port= "9898" message-transfer= "OCTET_COUNTING" /> </syslog-handler> </handlers> <logger log-boot= "true" log-read-only= "false" enabled= "true" > <handlers> <handler name= "file" /> <handler name= "audit-test-syslog-handler" /> </handlers> </logger> </audit-log> 2) start application server and syslog server 3) make some audit operation -> audit message is logged to syslog 4) restart syslog 5) make some audit operation -> audit message is not logged to syslog