Forward Events over Syslog

Syslog is the channel a SIEM or a log collector expects, and the one most deployments use. xorlab appears on the other side as a generic Syslog source, so no vendor app or connector is involved.

​

Configure the appender

1. In the Expert Editor, go to the directory of the container that emits your event, listed in How Logging Works. For audit.* events that is xcc/backend/.
2. Open logback-audit.xml, or create it if it does not exist yet.
3. Add the appender and the logger:
   xcc/backend/logback-audit.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <hostName>xorlab</hostName>
           <protocol>UDP</protocol>
           <facility>LOCAL0</facility>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender>
   
       <!-- Change the name to the event you chose -->
       <logger name="audit">
           <appender-ref ref="syslogAppender"/>
       </logger>
   </included>
   
4. Set syslogHost and port to your Syslog destination, and hostName to the name your SIEM should show as the log source. Every parameter the appender accepts is under Available attributes.
5. Set logger name to the event you chose.
6. Set pattern to the format you chose. %jsonMsg%n above is the default; the alternatives are in Format Converters.
7. For TCP or TLS instead of UDP, apply Use Syslog with TCP or TLS before publishing.
8. Click Publish. The logging configuration becomes active within about one minute.
9. Confirm the events arrive: Verify and Troubleshoot Logging.

​

Use Syslog with TCP or TLS

UDP truncates messages at 1500 bytes. Use TCP for anything you rely on, and TLS whenever the logs leave your network, for example to a cloud-hosted SIEM.

1. Set protocol to TCP or to SSL for TLS.
2. Wrap the Syslog appender in an AsyncAppender and reference that from the logger:
   xcc/backend/logback-audit.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <facility>LOCAL0</facility>
           <!-- Either TCP or SSL -->
           <protocol>TCP</protocol>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender>
   
       <!-- Wrap the AsyncAppender around the SyslogAppender -->
       <appender name="asyncSyslogAppender" class="ch.qos.logback.classic.AsyncAppender">
           <appender-ref ref="syslogAppender" />
       </appender>
   
       <!-- Reference the AsyncAppender, not the SyslogAppender -->
       <logger name="audit" >
           <appender-ref ref="asyncSyslogAppender"/>
       </logger>
   </included>
   

3. Click Publish. The logging configuration becomes active within about one minute.

For an unsigned certificate on the receiving side, add trustAll. If the TCP connection is dropped by an idle timeout on a firewall, see Keep a TCP connection alive.

​

Available attributes

​

Where to configure the receiving side

The work on the other end is your platform’s standard “add a Syslog source” procedure. Connect a SIEM links the vendor documentation for Splunk, Microsoft Sentinel, QRadar, Elastic, Graylog, and others.