Skip to main content

Syslog Ports

Syslog listening ports exist in two places:

  • On the platform, as the cloud syslog endpoint — described on this page.
  • On a collector appliance, as per-collector listener ports — see Collector configuration.

The platform page itself, control by control, is documented in the interface reference at Platform → Administration → Syslog Ports, which is canonical for what the screen contains.

Cloud syslog endpoint​

There is only one cloud collector per instance. This acts as the cloud termination point for sending syslog across the internet.

The Syslog Ports page​

Platform → Administration → Syslog Ports (URL path /platform/syslogs) shows the platform's syslog listener configuration. Once configured, the body is a single card describing the listener:

Syslog Ports page showing a configured listener with domain, port range, per-protocol ports, and Update Config, Delete Syslog Config, and Download CA buttons

  • Domain — the hostname your devices send events to, such as rockville.syslog.ingext.io. This is the value that goes into the device's syslog destination.
  • Port range — the block of ports allocated to this configuration, such as 12000 – 12009.
  • Syslog TLS, TLS RFC 6587, Syslog UDP, Syslog TCP — one row per protocol. An enabled protocol shows the port it listens on, for example Syslog TLS on 12000; a disabled protocol shows a dash (–).

Three buttons sit below the card:

  • Update Config (blue) — opens the Update Syslog Config dialog to enable or disable protocols.
  • Delete Syslog Config (red) — removes the syslog configuration entirely.
  • Download CA (ca.crt) (green, right-aligned) — downloads the CA certificate that senders need in order to trust the TLS listeners. Install this on any device sending over Syslog TLS or TLS RFC 6587.

Take the domain from Domain and the port from the protocol row you intend to use — together they are the destination a device is pointed at. The ports outside the enabled ones in the range are unused until another protocol is turned on.

Enabling and disabling protocols​

Click Update Config to open the Update Syslog Config dialog, subtitled Enable or disable syslog protocols for this configuration. It offers one checkbox per protocol:

  • Syslog TLS
  • TLS RFC 6587
  • Syslog UDP
  • Syslog TCP

Check the protocols the platform should listen on, then click Save to apply the configuration or Cancel to close the dialog without saving. A protocol that is switched off stops showing a port and its senders stop being accepted, so change this only when you know what is pointed at the endpoint.

Update Syslog Config dialog with checkboxes for Syslog TLS, TLS RFC 6587, Syslog UDP, and Syslog TCP

Before anything is configured​

On an instance with no syslog configuration, the card is replaced by the message No syslog config found in red, and the header carries an Add Syslog Port button instead of the three buttons above.

Syslog Ports page empty state with the Add Syslog Port button and the No syslog config found message

Add Syslog Port opens the same Update Syslog Config dialog. Choose the protocols and save; the domain and port range are then allocated and the card above appears.

Update Syslog Config dialog opened from the Add Syslog Port button

Collector syslog ports​

A collector appliance has its own syslog listener ports, configured per collector from the portal rather than on this page. A default collector listens on udp and tcp on 514, tls on 6514, and tls (RFC6587) on 7514 — fixed numbers, unrelated to the per-tenant block above — and each of its listeners can carry a Customer Tag that attributes the records arriving on it. For those steps, see Managing Collectors → Collector configuration → Syslog ports.