SPP allows you to define one or more syslog servers to be used for logging SPP event messages. Appliance Administrators can specify to send different types of messages to different syslog servers. You may configure a connection to a syslog server to use TLS encryption, with or without a client authentication certificate. For more information, see Syslog Client Certificate.

To define and manage the syslog servers, go to Syslog:

  • web client: Navigate to External Integration > Syslog.

The Syslog pane displays the following about each syslog server defined.

Table 70: Syslog server: Properties
Property Description

Name

The name of the syslog server

Network Address The IP address or FQDN of the syslog server
Port The port number for syslog server

Protocol

The network protocols and syslog header type

TCP Framing

When using syslog with the TCP protocol, since the connection is stream based both the client and server need to be configured to process the data using the same delimiter. See RFC 6587 section 3.4.1 and 3.4.2 for more details. By default, SPP will use octet counting, as is recommended by RFC 6587. However, some syslog servers do not support octet counting. If that is the case, use this setting to configure SPP to use the delimiter that is supported by your syslog server.

Use TLS Encryption

If selected, provides encrypted communication with the syslog server instead of plain text over TCP

Use Client Certificate

If selected, the syslog server requires clients to authenticate

Verify Server Certificate

If selected, the syslog server certificate messages will only be sent if SPP is able to verify the authenticity of the syslog server TLS certificate

Use these toolbar buttons to manage the syslog server configurations

Table 71: Syslog server: Toolbar
Option Description
Add Add a new syslog server configuration. For more information, see Configuring and verifying a syslog server.
Remove

Remove the selected syslog server configuration from SPP.

If you attempt to remove a syslog server in use, you will see a message like: <syslog server> will be removed. Select Yes or No.

A second Force Delete message like this may display: There are dependencies on this syslog server: This object is referenced by ServiceDebug. Do you want to force delete this server? Select Force Delete or Cancel. If you select Force Delete, the dependent setting (such as an event subscriber or debug logging) will be deleted as well.

Edit Modify the selected syslog server configuration.
Copy Syslog Template Clone the selected syslog server configuration.
Refresh Update the list of syslog server configurations.