Section – Syslog Forwarding
GUI | Description |
|---|---|
Destination Host | Specifies the hostname (IPv4 only) or IP address of the remote log host — i.e., a server or service that receives logs via syslog. The log host will receive the Airlock Gateway messages specified in Log Level section. This is useful for centralized log management and monitoring system. |
Destination Port | Specifies the destination port, — i.e., |
Log Format | Specifies the format of messages forwarded to the configured log host. Valid options are JSON, CEF (for SIEM systems), and Raw. With Raw, messages are forwarded without processing; depending on the source, they may be plain text or JSON. The CEF format is available only for request summaries and blocked requests. |
Transport | Specifies the type of transport used for remote logging. Valid options to choose from are UDP (classic syslog), TCP (syslog-ng and other newer syslogs) or SSL. For details on using SSL with client certificates, see Syslog forwarding with SSL. |
System Errors | Using syslog, system related events and system errors are forwarded to the configured log host. |
Request Summaries | Using syslog, the summary line of each request handled by Airlock Gateway is forwarded to the configured log host. |
Blocked Requests | Using syslog, blocked request information is forwarded to the configured log host. |
Events | Using syslog, events related to web requests are forwarded to the configured log host. |
Specific Messages | Specifies a regex pattern to match against the text body of a message. Headers are not considered. All matching messages are forwarded to the configured log host. The following characters must be escaped with a preceding backslash if they are to be included as normal characters: Example Example \"log_id\":\"WR-SG-(?:BACK-50[02]|REJECT-[0-9]+|SESS-004)\" Functional limitation A weak filter matches many log messages, resulting in a high volume of messages being forwarded. This can negatively impact performance.
Notice
|