Syslog Import

Fluency appliance has the ability to accept and parse a variety of input formats (within the Syslog protocol). It is likely that your particular device provides output in a format that Fluency can already ingest.

When exporting data from your device, choose the JSON (preferred) or CEF formats for export whenever possible.

You can find a current list of supported services on the Integration Matrix page.

Ten common syslog devices have an application template under On-Premise IT in the catalog — Check Point, Cisco ASA, Cisco Meraki, FortiGate, Linux (RHEL), Palo Alto, Peplink, SonicWall, Sophos Firewall and Sophos UTM. Installing one supplies the parser and builds the pipeline, so the only remaining work is pointing the device at a listener. See On-Prem / Syslog.

The listener itself is an application too: Fluency Syslog Endpoint, under System Components, is the cloud syslog endpoint, and it takes no parameters.

In cases where Fluency does not have a parser available, please contact Fluency support. Fluency will aim to create one at no cost to the customer.

About Syslog

Syslog is a standard protocol used for sending and receiving log messages in a network. It's commonly used in Unix-like operating systems, network devices, and applications to collect and centralize logs for monitoring, troubleshooting, and analysis.

In essence, syslog works by allowing various devices and applications to send log messages to a centralized syslog server or a syslog collector. These messages typically contain information about events, errors, warnings, or other significant occurrences within the system or application.

Syslog messages usually consist of a timestamp, the hostname or IP address of the sending device, a facility code indicating the type of program or service that generated the message, a severity level indicating the importance of the message, and the actual log message itself.

Syslog servers can store these messages locally or forward them to other systems or services for further processing, analysis, or archival. It provides a standardized way for different components of a system to communicate their status and activities, which is invaluable for system administrators and IT professionals in managing and troubleshooting complex networks and systems.

Where to send: the two destinations

A device sends to one of two listeners, and they do not use the same ports. Pointing a device at the wrong one produces no error anywhere — the records simply never arrive.

The cloud syslog endpoint

The cloud endpoint has a per-tenant domain and a block of ports allocated to your account. There is no standard port number to copy: the domain and the port for each protocol are shown on Platform → Administration → Syslog Ports, and both are specific to your tenant.

Read the destination off that page:

• Domain — the hostname the device sends to, such as rockville.syslog.ingext.io.
• The protocol row you intend to use — Syslog TLS, TLS RFC 6587, Syslog UDP or Syslog TCP — shows the port it listens on. A protocol that is switched off shows a dash instead of a port.

Prefer one of the two TLS protocols when sending across the internet. Syslog TLS carries plain TLS framing; TLS RFC 6587 carries octet-counted framing, which some devices — FortiGate among them — emit instead. The two are not interchangeable: a device sending RFC 6587 framing to the plain TLS listener connects successfully and its records never parse.

Both TLS listeners present a certificate the sender has to trust. The Download CA (ca.crt) button on the Syslog Ports page supplies that certificate; install it on the sending device before configuring TLS, or the handshake fails with no message on the platform side.

See Syslog Ports for the page in full.

A collector appliance

A collector on the customer's own network listens on fixed default ports:

Protocol	Default port
udp	514
tcp	514
tls	6514
tls (RFC6587)	7514

These are the numbers a reader will recognise — 514 for traditional syslog, 6514 for syslog over TLS — and they apply only to a collector, not to the cloud endpoint. Each collector listener can carry a Customer Tag, which is how records arriving on a given port are attributed to a site or a customer; the cloud endpoint has no equivalent per-port field.

Send over UDP/514 only inside a trusted network. A device that can do nothing but UDP syslog should reach a local collector, which then forwards to the platform over HTTPS, rather than sending in the clear across the internet.

See Managing Collectors → Collector configuration for the listener settings.

Types of Collectors

Remote (virtual) collectors are an effective way to send data across the internet in a manageable and secure manner.

There are two types of collectors:

• The SaaS instance has a cloud collector — see Syslog Ports
• A virtual collector extends the collection points to local environments — see Fluency Collector to install one, and Managing Collectors to add and configure it from the portal

Usually, collectors are used to move local syslog audit data into the Fluency system. When sending syslog, the collector acts as the terminating point.

In this section

• Syslog Ports — the cloud syslog endpoint and the collector's listener ports.
• Linux Syslog — forwarding from Linux hosts with rsyslog.