Skip to main content

On-Prem / Syslog

This section covers devices and servers that live on the customer's own network and export their logs as syslog: perimeter firewalls, SD-WAN routers, Linux servers and on-premise data-security products. Unlike the API-based cloud integrations, nothing here is polled: the device pushes to a listener, either the cloud syslog endpoint or a local collector appliance, and the platform parses what arrives. Firewall and server syslog remains the backbone of network visibility: it is where allow/deny decisions, VPN sessions, administrative logins and privilege escalation are recorded.

In this section​

  • Check Point Firewall: Security Gateway and management-server logs, typically exported with Log Exporter.
  • Cisco ASA: stateful firewall and VPN concentrator syslog, identified by numeric message IDs; the same template parses Firewall Threat Defense (FTD) syslog.
  • Cisco Meraki: cloud-managed MX/MS/MR devices, with syslog roles selected per network.
  • Fortinet FortiGate: FortiOS traffic, UTM and event logs.
  • Linux (RHEL) Syslog: rsyslog forwarding from enterprise Linux servers.
  • Palo Alto NGFW: PAN-OS traffic, threat, URL, system and config logs.
  • Peplink SD-WAN: syslog plus NetFlow and the InControl API.
  • SonicWall NGFW: SonicOS firewall and SSL-VPN syslog.
  • Sophos Firewall: the current Sophos Firewall (XG/XGS) product line.
  • Sophos UTM: the older Sophos UTM 9 appliance line.
  • Ubiquiti UniFi Network: gateway, switch and access-point events from a UniFi Network deployment, exported as CEF.
  • Varonis DatAdvantage: file-activity and data-access alerts from the Varonis platform.
  • VMware ESXi: hypervisor host logs: authentication, shell and DCUI access, and virtual-machine lifecycle.

Every Device but One Has a Template​

Twelve of the thirteen devices in this section have an application template in the catalog, under On-Premise IT. Installing one builds the whole pipeline (source, parser, router and sink), and none of them has settings of its own to fill in: the install form has no Configuration section (v1: an empty Parameters section), because the template supplies the parser and the transport is configured on the syslog listener rather than on the form.

Five of them do let you name the destination, in the collapsed Advanced configuration section of the form (v1: the Advanced Configurations row below the parameters): Check Point Firewall Syslog, Cisco ASA Syslog, Cisco Meraki Syslog, PaloAlto Firewall Syslog and SonicWall NGFW Syslog each carry a datalake and a datalake index name. The other seven write to an index the template fixes.

Varonis DatAdvantage is the exception: it sends syslog like the rest, but has no template, so its parser has to be built by hand.

How syslog reaches the platform​

Every device in this section sends to a syslog listener rather than being polled. The destination is either your tenant's cloud syslog endpoint or a local collector appliance, and the two use different ports.

Cloud syslog endpoint. A per-tenant domain with a block of ports allocated to your account. Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports) shows the domain, the port range, and which protocol listens on which port; the numbers are specific to your tenant, so read them there rather than assuming a standard port.

Collector appliance. A new collector listens on UDP/514 and TCP/514; a TLS listener (usually 6514 for TLS, 7514 for TLS RFC 6587) is one you add on its Syslog Ports tab and open in the collector's firewall. Each listener can carry a Customer Tag, which is how records arriving on a given port are attributed to a site or customer.

TLS in either case. Both destinations present a certificate the sending device has to trust. Download it with the Download CA (ca.crt) button on Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports) and install it on the device before configuring TLS; without it the handshake fails and nothing is logged on the platform side. Note also that Syslog TLS and TLS RFC 6587 are different framings, not alternatives: a device that emits octet-counted frames must go to the RFC 6587 listener or its records will not parse.

Last updated on