What is Syslog; how are TR7 logs forwarded with Syslog?

Short answer

Syslog is the standard protocol that carries log messages over the network to a central log server (RFC 5424). In TR7, there are three separate Syslog paths depending on the log type. The device's own logs (User Logs, Notification Logs, GTM Logs, Health Check Logs) are sent with Log Forwarding profiles: Transport Type is Syslog, Protocol is UDP (default) or TCP, and Port is 514 by default; the header format is selected with Syslog Format as RFC 3164 (BSD) or RFC 5424, and the message body with Message Format as JSON, CEF or Plain Text. vService access and WAF logs are sent to the Log Addresses list of the Logs profile assigned to the vService, and AGS audit events to the Log Forwarding profiles under AGS → Integrations. In a cluster, the settings are synchronized; each device sends the logs it produces itself.

Where It Is Used in TR7

Where	Field / label	What for
Settings → General Settings → Log Forwarding → Add	Transport Type (Syslog), Route Table, Syslog Server, Port, Protocol	Target of the device logs
Same form	Syslog Format, Message Format, Application Name	Syslog header format, message body and application name
Same form	Log Language, Log Sources, Send Change Details	The log sources to be sent (by default, those other than Health Check Logs) and their language
Load Balancer → Profiles → Logs	Log Addresses, Line Format, Log Standard	Target, line format and Syslog standard of the vService access and WAF logs
AGS → Integrations → Log Forwarding	Log Forwarding profile; Audit Log Forwarders (at most 5 profiles) in the vService's AGS settings	Sending AGS audit events (login, MFA, lockout, session)

Three Paths

	Settings → Log Forwarding	Logs profile	AGS → Log Forwarding
What it carries	User, Notification, GTM and Health Check logs	vService access logs; attack information if WAF is enabled	AGS audit events
Where it is attached	Device-wide	vService (LOG option)	The vService's Audit Log Forwarders list
Message format	JSON, CEF, Plain Text	Line format options (Standard Log Format, Apache Combined and Apache VHost formats, CEF Format, TR7 JSON Format, TR7 WAF Log, Manual JSON Format, Manual CEF Format, Manual Log Line Format)	JSON, CEF

• Sending steps for vService logs: How do I send logs to a SIEM (Syslog)?
• Header formats: What is the difference between the RFC 3164 (BSD) and RFC 5424 Syslog formats? · Message formats: What is the difference between the JSON, CEF and Plain Text message formats for log forwarding?

Common Misconceptions

• "Log Forwarding also sends vService traffic logs." Traffic logs go with the Logs profile assigned to the vService; Log Forwarding carries device logs.
• "In a cluster, a single device collects and sends the logs." The settings are synchronized, but each device sends the logs it produces itself; two sources appear on the log server.
• "Health check logs are sent by default." In the Log Forwarding profile, Health Check Logs is not selected by default; even when it is selected, only status changes are sent while Log All Health Checks is off.

How it is done in the documentation

• Log Forwarding · What Is Log Forwarding?
• Log Forwarding · Syslog Settings
• Logs profile · SIEM Integration
• AGS · Log Forwarding

Related questions

• How do I send logs to a SIEM (Syslog)?
• What is a SIEM; what does sending TR7 logs to a SIEM provide?
• What is the difference between Log Forwarding and File Forwarding?