Enable Logging via Syslog

1. Open the logback-audit.xml as created in Before You Begin.
2. Add the following appender and logger:
   logback-audit.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <hostName>xorlab</hostName>
           <protocol>UDP</protocol>
           <facility>LOCAL0</facility>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender>
       <!-- Change the name to the desired Event -->
       <logger name="audit">
           <appender-ref ref="syslogAppender"/>
       </logger>
   </included>
   
3. Adjust syslogHost and port to match your Syslog destination. For a list of all available attributes, see Available attributes.
4. Optional: Adjust pattern to the chosen format as described in Before You Begin
5. Adjust the logger name to match the event that you want to log.
6. If you want to use TCP or TLS instead of UDP, follow below Use Syslog with TCP or TLS.
7. Click Publish. The logging configuration becomes active within about one minute.

​

Use Syslog with TCP or TLS

1. Set protocol to either TCP or SSL.
2. Add an AsyncAppender wrapper:
   logback-audit.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <facility>LOCAL0</facility>
           <!-- Either TCP or SSL -->
           <protocol>TCP</protocol>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender> 
       
       <!-- Wrap the AsyncAppender around the SyslogAppender -->
       <appender name="asyncSyslogAppender" class="ch.qos.logback.classic.AsyncAppender">
           <appender-ref ref="syslogAppender" />
       </appender>
       <!-- Reference the AsyncAppender -->
       <logger name="audit" >
           <appender-ref ref="asyncSyslogAppender"/>
       </logger>
   </included>
   

   AsyncAppender Adding an AsyncAppender is mandatory for TCP and TLS, otherwise xorlab might not work properly.

​

Available attributes

​

KeepAlive appender for timeout issues

<?xml version="1.0" encoding="UTF-8"?>
<included>

  <!-- Standard Syslog appender -->
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <hostName>xorlab</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Additional KeepAlive appender to trigger periodic keep alives via the Syslog appender.
      This appender should not be referenced by any logger. -->
  <appender name="keepAliveSyslogAppender" class="com.xorlab.sgappliance.shared.logback.KeepAliveAppender">
    <!-- Optional config showing their default values -->
    <!--
    <intervalHours>1</intervalHours>
    <intervalMinutes>60</intervalMinutes>
    <intervalSeconds>3600</intervalSeconds>
    <intervalMilliseconds>3600000</intervalMilliseconds>
    <logType>NOOP</logType>
    <message>noop</message>
    <level>DEBUG</level>
    -->
    <appender-ref ref="syslogAppender"/>
  </appender>

  <!-- Reference the keepAliveSyslogAppender, NOT the syslogAppender -->
  <logger name="audit">
    <appender-ref ref="keepAliveSyslogAppender"/>
  </logger>
</included>