> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Enable Logging via Syslog

> Forward selected log events over Syslog to a destination such as a SIEM.

<Warning>
  **Prerequisites**

  * Complete [Before You Begin](/latest/logging-before-begin)
</Warning>

Follow these steps:

1. Open the `logback-audit.xml` as created in [Before You Begin](/latest/logging-before-begin#choose-log-event).
2. Add the following `appender` and `logger`:
   ```xml logback-audit.xml theme={null}
   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <hostName>xorlab</hostName>
           <protocol>UDP</protocol>
           <facility>LOCAL0</facility>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender>
       <!-- Change the name to the desired Event -->
       <logger name="audit">
           <appender-ref ref="syslogAppender"/>
       </logger>
   </included>
   ```
3. Adjust `syslogHost` and `port` to match your Syslog destination. For a list of all available attributes, see [Available attributes](#available-attributes).
4. Optional: Adjust `pattern` to the chosen format as described in [Before You Begin](/latest/logging-before-begin#choose-log-format)
5. Adjust the `logger name` to match the event that you want to log.
6. If you want to use **TCP** or **TLS** instead of UDP, follow below [Use Syslog with TCP or TLS](#use-syslog-with-tcp-or-tls).
7. Click **Publish**. The logging configuration becomes active within about one minute.

## Use Syslog with TCP or TLS

To enable Syslog with TCP or TLS:

1. Set `protocol` to either `TCP` or `SSL`.
2. Add an `AsyncAppender` wrapper:
   ```xml logback-audit.xml highlight={8,15-17,21} theme={null}
   <?xml version="1.0" encoding="UTF-8"?>
   <included>
       <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
           <syslogHost>syslog.example.com</syslogHost>
           <port>514</port>
           <facility>LOCAL0</facility>
           <!-- Either TCP or SSL -->
           <protocol>TCP</protocol>
           <encoder>
               <pattern>%jsonMsg%n</pattern>
           </encoder>
       </appender> 
       
       <!-- Wrap the AsyncAppender around the SyslogAppender -->
       <appender name="asyncSyslogAppender" class="ch.qos.logback.classic.AsyncAppender">
           <appender-ref ref="syslogAppender" />
       </appender>
       <!-- Reference the AsyncAppender -->
       <logger name="audit" >
           <appender-ref ref="asyncSyslogAppender"/>
       </logger>
   </included>
   ```
   <Warning>
     **AsyncAppender**
     Adding an `AsyncAppender` is mandatory for TCP and TLS, otherwise xorlab might not work properly.
   </Warning>

## Available attributes

The following configuration parameters are supported by the syslog appender:

| Parameter              | Description                                                                                                                                                                                                                                                                                                             |
| :--------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `syslogHost`           | Mandatory syslog daemon host                                                                                                                                                                                                                                                                                            |
| `port`                 | Configure port of the rsyslog daemon (default: 514)                                                                                                                                                                                                                                                                     |
| `protocol`             | `UDP`, `SSL`, or `TCP` (default: `UDP`)<br />**Note**: Use `AsyncAppender` for SSL and TCP as described in the [Use Syslog with TCP or TLS](#use-syslog-with-tcp-or-tls) section                                                                                                                                        |
| `hostName`             | Specify a host name to be included in the log. This is important for log source identifiers in SIEM systems.                                                                                                                                                                                                            |
| `facility`             | [Syslog facility](https://en.wikipedia.org/wiki/Syslog#Facility)<br />Pick one of these: `KERN`, `USER`, `MAIL`, `DAEMON`, `AUTH`, `SYSLOG`, `LPR`, `NEWS`, `UUCP`, `CRON`, `AUTHPRIV`, `FTP`, `NTP`, `LOG_AUDIT`, `LOG_ALERT`, `CLOCK`, `LOCAL0`, `LOCAL1`, `LOCAL2`, `LOCAL3`, `LOCAL4`, `LOCAL5`, `LOCAL6`, `LOCAL7` |
| `format`               | Syslog message format: `RFC3164` (default) or `RFC5424`                                                                                                                                                                                                                                                                 |
| `pattern`              | Syslog message payload structure and format (e.g., JSON or CEF). For more information, please see [Formats](/latest/logging-formats)                                                                                                                                                                                    |
| `trustAll`             | Allow the use of unsigned TLS certificates                                                                                                                                                                                                                                                                              |
| `reconnectDelayMillis` | Duration between reconnect attempts in milliseconds (default: 30000)                                                                                                                                                                                                                                                    |
| `immediateFail`        | `true`, `false` (default: `true`). If set to `false`, log messages will be blocked until (re)-connected.<br />**Important**: Only set to `false` while using `AsyncAppender`                                                                                                                                            |
| `messageSizeLimit`     | Optionally constrain message size by truncating it. While using UDP transport, this config's default value is set to 1500 bytes (as this is a common network MTU size). Example: `<messageSizeLimit>1500</messageSizeLimit>`                                                                                            |
| `socketOptions`        | Supports the following two child parameters: `keepAlive` (`true` or `false`, default: `true`) and `tcpNoDelay` (`true` or `false`, default: `false`). Example: `<socketOptions><keepAlive>true</keepAlive></socketOptions>`                                                                                             |

## KeepAlive appender for timeout issues

The KeepAlive appender can be used to periodically trigger another appender to log a keep alive event. It's main use case is together with the Syslog Appender to make sure the underlying TCP connection does not time out.

<Note>
  The KeepAlive appender is not required for normal operations. It is only used in special cases if there are underlying TCP related connection issues.
</Note>

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<included>

  <!-- Standard Syslog appender -->
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <hostName>xorlab</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Additional KeepAlive appender to trigger periodic keep alives via the Syslog appender.
      This appender should not be referenced by any logger. -->
  <appender name="keepAliveSyslogAppender" class="com.xorlab.sgappliance.shared.logback.KeepAliveAppender">
    <!-- Optional config showing their default values -->
    <!--
    <intervalHours>1</intervalHours>
    <intervalMinutes>60</intervalMinutes>
    <intervalSeconds>3600</intervalSeconds>
    <intervalMilliseconds>3600000</intervalMilliseconds>
    <logType>NOOP</logType>
    <message>noop</message>
    <level>DEBUG</level>
    -->
    <appender-ref ref="syslogAppender"/>
  </appender>

  <!-- Reference the keepAliveSyslogAppender, NOT the syslogAppender -->
  <logger name="audit">
    <appender-ref ref="keepAliveSyslogAppender"/>
  </logger>
</included>
```