Configures forwarding of audit and security events to an external syslog server. Syslog integration allows centralised log management with tools such as Splunk, Graylog, ELK Stack, or a SIEM.

Settings

Enabled

Activates syslog forwarding. Enabled by default.

Host

The hostname or IP address of the syslog server (e.g. syslog.example.com or 192.168.1.10 ). Required.

Port

The UDP or TCP port on which the syslog server is listening. Default is 514.

Protocol

UDP (default) – Connectionless, lower overhead, messages may be lost under network congestion.
TCP – Connection-oriented, reliable delivery, recommended for production.

Note

Optional internal note describing the syslog configuration (not forwarded to the server).

For secure syslog over TLS, configure a TCP syslog relay on the local machine and forward encrypted traffic from there to the remote SIEM.