Skip to main content

On-Prem / Syslog

This section covers devices and servers that live on the customer's own network and export their logs as syslog: perimeter firewalls, SD-WAN routers, Linux servers and on-premise data-security products. Unlike the API-based cloud integrations, nothing here is polled — the device pushes to a listener, either the cloud syslog endpoint or a local collector appliance, and the platform parses what arrives. Firewall and server syslog remains the backbone of network visibility: it is where allow/deny decisions, VPN sessions, administrative logins and privilege escalation are recorded.

In this section​

  • Check Point Firewall — Security Gateway and management-server logs, typically exported with Log Exporter.
  • Cisco ASA — stateful firewall and VPN concentrator syslog, identified by numeric message IDs.
  • Cisco Meraki — cloud-managed MX/MS/MR devices, with syslog roles selected per network.
  • Fortinet FortiGate — FortiOS traffic, UTM and event logs.
  • Palo Alto NGFW — PAN-OS traffic, threat, URL, system and config logs.
  • Peplink SD-WAN — syslog plus NetFlow and the InControl API.
  • SonicWall NGFW — SonicOS firewall and SSL-VPN syslog.
  • Sophos Firewall — the current Sophos Firewall (XG/XGS) product line.
  • Linux (RHEL) Syslog — rsyslog forwarding from enterprise Linux servers.
  • Sophos UTM — the older Sophos UTM 9 appliance line.
  • Ubiquiti UniFi Network — gateway, switch and access-point events from a UniFi Network deployment, exported as CEF.
  • VMware ESXi — hypervisor host logs: authentication, shell and DCUI access, and virtual-machine lifecycle.
  • Varonis DatAdvantage — file-activity and data-access alerts from the Varonis platform.

Every Device Here Has a Template​

Twelve of the thirteen devices in this section have an application template in the catalog, under On-Premise IT. Installing one builds the whole pipeline — source, parser, router and sink — and most take no parameters at all in the Parameters section, because the template supplies the parser and the transport is configured on the syslog listener rather than on the form.

Five of them do let you name the destination, in the collapsed Advanced Configurations row below the parameters: Check Point Firewall Syslog, Cisco ASA Syslog, Cisco Meraki Syslog, PaloAlto Firewall Syslog and SonicWall NGFW Syslog each carry a datalake and a datalake index name. The other seven write to an index the template fixes.

Varonis DatAdvantage is the exception: it sends syslog like the rest, but has no template, so its parser has to be built by hand.

How syslog reaches the platform​

Every device in this section sends to a syslog listener rather than being polled. The destination is either your tenant's cloud syslog endpoint or a local collector appliance, and the two use different ports.

Cloud syslog endpoint. A per-tenant domain with a block of ports allocated to your account. Platform → Administration → Syslog Ports shows the domain, the port range, and which protocol listens on which port — the numbers are specific to your tenant, so read them there rather than assuming a standard port.

Collector appliance. A default collector listens on UDP/514, TCP/514, TLS on 6514, and TLS RFC 6587 on 7514. Each listener can carry a Customer Tag, which is how records arriving on a given port are attributed to a site or customer.

TLS in either case. Both destinations present a certificate the sending device has to trust. Download it with the Download CA (ca.crt) button on Platform → Administration → Syslog Ports and install it on the device before configuring TLS — without it the handshake fails and nothing is logged on the platform side. Note also that Syslog TLS and TLS RFC 6587 are different framings, not alternatives: a device that emits octet-counted frames must go to the RFC 6587 listener or its records will not parse.