# Syslog

Receive RFC 5424 and RFC 3164 syslog over UDP or TCP on a Tracix Collector, use the vendor log integrations, and find the logs in Log Explorer.

A Tracix Collector can listen for syslog from your network devices, firewalls and servers, and store each message as a structured log in your workspace. Use the **Syslog** integration for any device that sends standard syslog, or a vendor integration for a device Tracix knows how to parse.

## Set up syslog

**1. Open the connect steps**

In your workspace, open **Collectors › Integrations** and select the **Syslog** tile, under **Logs & Events**.

**2. Choose the collectors**

Syslog goes to your own collectors. Under **Where to add this integration**, pick the policy of the collectors your devices will send to, or create one.

**3. Choose the format and transport**

Set **Format** to **RFC 5424 (modern)**, the default, or **RFC 3164 (BSD)**. For RFC 3164, which has no time zone in its timestamps, set **Timezone** under the advanced settings. Set **Transport** to **udp**, the default, or **tcp**.

**4. Choose the port**

**Listen address** defaults to `0.0.0.0:514`. Use a port of 1024 or above on collectors that can't open low ports; see below.

**5. Connect and point your devices at it**

Select **Review**, then **Connect**. Then set each device's syslog destination to a collector's address on that port and transport, and allow the port through the host's firewall.

Each integration listens on one transport. To receive both UDP and TCP, add a second **Syslog** integration with a different name. For TCP senders that frame messages by length, turn on **Octet counting (RFC 6587)**. The integration has no TLS option.

### Ports below 1024

A collector that can't open a port below 1024 isn't given a listener there; its other integrations keep running.

* **Linux** hosts installed before the installer granted that permission need the current installer run once.
* **Kubernetes** collectors on the chart's default profile can't bind 514. Listen on `0.0.0.0:1514` and send to the node on 1514, or redirect 514 to 1514 on every node.
* **Docker** collectors need the listen port published when you run them, such as `-p 514:514/udp` for the default; the console's command publishes only the SNMP trap port.
* **Windows** collectors are covered by the firewall rule the installer adds.

## How syslog is parsed

The collector parses the syslog header and keeps the message. Fields get standard names:

| Syslog field                                 | Stored as                                                                        |
| -------------------------------------------- | -------------------------------------------------------------------------------- |
| App name                                     | `syslog.identifier`                                                              |
| Host name                                    | `host.name`                                                                      |
| Process ID                                   | `process.pid`                                                                    |
| Message ID                                   | `syslog.msgid`                                                                   |
| Priority, facility, version, structured data | `syslog.priority`, `syslog.facility`, `syslog.version`, `syslog.structured_data` |

To parse the message itself further, edit the log pipeline for the `syslog` dataset under **Settings › Data Management › Pipelines**. See [Logs and pipelines](https://tracix.io/docs/observe/logs).

## Vendor log integrations

Vendor integrations listen on their own port and parse that vendor's messages into fields with a pipeline built for them. Each one stores its logs in a dataset named after the integration. Some network examples, with their default UDP ports:

| Integration               | Default port |
| ------------------------- | ------------ |
| Fortinet FortiGate        | 5514         |
| Cisco ASA                 | 5515         |
| Palo Alto Networks PAN-OS | 5516         |
| Check Point               | 5517         |
| Juniper SRX               | 5518         |
| Cisco IOS                 | 5531         |
| Cisco Nexus               | 5532         |
| Infoblox NIOS             | 5555         |
| HPE Aruba Networking CX   | 5561         |

Find them, and many security products, in [the integrations catalog](https://tracix.io/integrations). They need a recent collector: older collectors aren't given these integrations until they are upgraded.

## Find your logs

Open **Insights › Log Explorer** and filter by dataset: `syslog` for the Syslog integration, or the vendor integration's name, such as `cisco_ios`. SNMP traps from the same devices are in the `snmp.traps` dataset; see [SNMP polling and traps](https://tracix.io/docs/collect/network-data/snmp).

## Next steps

- [Logs and pipelines](https://tracix.io/docs/observe/logs): Search logs and parse them further

- [Ports, proxies and firewalls](https://tracix.io/docs/collect/collector/ports-and-proxies): Open the syslog port

- [Integrations catalog](https://tracix.io/docs/collect/integrations): Find a vendor integration