How do I send logs to a SIEM (Syslog)?

Short answer

There are two separate paths. The access logs of the vService are sent by entering the protocol (UDP or TCP), address and port of the SIEM or syslog server in the Log Addresses field of a Load Balancer → Profiles → Logs profile, and by checking LOG on the vService and selecting the profile; for a SIEM, CEF Format or TR7 JSON Format is selected as the Line Format (SIEM integration). The system logs of the device (User Logs, Notification Logs, GTM Logs and Health Check Logs), in turn, are forwarded over syslog in JSON, CEF or Plain Text format with a Settings → General Settings → Log Forwarding profile (Log Forwarding). On both paths, sending is done with UDP or TCP; there is no syslog over TLS option.

Problem: Logs Are Not Collected Centrally

The security team collects the logs of all systems in the SIEM; the requests passing through TR7 and the management operations performed on the device are also wanted to be searchable and storable in the same place. Since the logs on the device are limited by a size budget, long-term storage is also done on the log server.

Solution: Three Methods

Method 1 and Method 2 carry different logs and can be used together; Method 3 creates the same profiles from the command line.

Your situation	Suitable method
vService access logs (HTTP and L7 TCP request and connection lines)	Method 1: Logs profile + LOG
Device system logs (user operations, notifications, GTM, health checks)	Method 2: Log Forwarding
From the command line	Method 3: WEB-CLI

Method 1: Logs Profile Recommended

• How it works The profile sends the request and connection lines of the vServices with LOG on to the log addresses in the selected format; at most 10 addresses are defined in a profile.
• Where it is openedLoad Balancer → Profiles → Logs
• Requirement Network access from TR7 to the syslog server
• vService type HTTP · L7 TCP (there is no LOG on a Network vService)

Step-by-Step Configuration

1

Adım 1 Open the profile form

The profile form is opened with Load Balancer → Profiles → Logs → Add (how to add).

2

Adım 2 Enter the log address

Name is entered. In the Log Addresses row, the protocol (UDP or TCP), the IP address or domain name of the SIEM (e.g. 192.0.2.50) and the port (e.g. 514) are entered; another target can be added with +. Sampling is left off; if it is turned on, only one of every 10 logs is sent to that address.

3

Adım 3 Select the standard and format

Log Standard is selected according to the header format the SIEM expects (e.g. rfc5424), and Line Format is selected as CEF Format or TR7 JSON Format for a SIEM. The difference between the formats: Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?

4

Adım 4 Save the profile

Add in the form is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected (how to add to a vService).

6

Adım 6 Check LOG and select the profile

In the Details panel, LOG is checked and the created profile is selected in the Log Profile field. If the built-in Stream Log remains selected, the logs are kept only on the device and are not sent out.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync the change is also sent to the peer device, and both devices send the logs of their own traffic to the same addresses; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1SIEMExternal system

A request is sent to the vService, and a line with the vService name is searched for in the SIEM.

ExpectedA line starting with CEF:0|TR7|TR7 ASP|… (CEF Format)

Method 2: Log Forwarding

• How it works The Log Forwarding profile forwards the selected system log sources to the syslog server; each profile is one target, and more than one profile means more than one target.
• Where it is openedSettings → General Settings → Log Forwarding
• Requirement Network access from TR7 to the syslog server
• Scope Device-wide; not bound to a vService

Step-by-Step Configuration

1

Adım 1 Open the profile form

The profile form is opened with Settings → General Settings → Log Forwarding → Add (add form).

2

Adım 2 Enter the target and format

Name is entered; if needed, a Route Table is selected. Syslog server, Port (default 514), Protocol (default UDP; TCP can be selected), Syslog Format (default RFC 3164 (BSD); RFC 5424 can be selected) and Message Format (default JSON; CEF or Plain Text can be selected) are entered.

3

Adım 3 Select the log sources

In the Log Sources field, the needed ones among User Logs, Health Check Logs, Notification Logs and GTM Logs are selected; all except Health Check Logs are selected by default. If Health Check Logs is selected, Log all health checks (while off, only status changes) appears; if User Logs is selected, Send change details (on by default) appears.

4

Adım 4 Save the profile

Add in the form is clicked.

Verification

1SIEMExternal system

A setting is changed and saved in the interface, and a user operation record is searched for in the SIEM.

ExpectedThe record arrives

Method 3: WEB-CLI

• How it works The Logs profile and the Log Forwarding profile are created from the command line; the Logs profile is assigned to the vService.
• Where it is opened TR7 WEB-CLI → lb log · settings log-transport
• Requirement WEB-CLI access
• vService type HTTP · L7 TCP (Log Forwarding is device-wide)

Step-by-Step Configuration

1

Adım 1 Create the Logs profile

--logAddresses.0.ip.ip and --logAddresses.0.ip.port are the first log address, and --lineFormat cef is CEF Format (log servers). The protocol is not selected on the command line; sending is done with UDP. If TCP is needed, the protocol is selected from the interface.

lb log add name siem --lineFormat cef --logStandard rfc5424 --logAddresses.0.ip.ip 192.0.2.50 --logAddresses.0.ip.port 514

2

Adım 2 Assign the profile to the vService

It is assigned by the profile name (bound profiles):

lb service update id <vService> --log siem

3

Adım 3 Create the Log Forwarding profile for system logs

transportType syslog is required; --syslogMessageFormat cef selects the CEF format, and --sources.0 … --sources.2 select the User Logs, Notification Logs and GTM Logs sources (syslog destination, content fields).

settings log-transport add name siem-sistem transportType syslog --syslogHost 192.0.2.50 --syslogProtocol tcp --syslogFormat rfc5424 --syslogMessageFormat cef --sources.0 userLogs --sources.1 notificationLogs --sources.2 gtmLogs

Verification

1ProfileTR7 side

Command: lb service show <vService>

Expectedsiem profile in the log field

2SIEMExternal system

A request is sent to the vService, and the line is searched for in the SIEM.

ExpectedThe line arrives

Common Mistakes

• Selecting the Stream log profile and expecting sending. Stream log only enables the on-device logs; it does not send logs out.
• Assuming that Log Forwarding also carries the vService access logs. Log Forwarding forwards only the system log sources; the access logs are sent with the Logs profile.
• Expecting syslog over TLS (6514). Sending is done with UDP or TCP, unencrypted.
• Leaving Sampling on by mistake. Only one of every 10 logs goes to an address with Sampling on.
• Expecting debug records in the SIEM. Debug Mode records are not sent out; they are kept only on the device.
• Deleting a Logs profile that is in use. On the vServices that use the deleted profile, logging stops completely.

How it is done in the documentation

• Logs profile · Log Addresses
• Logs profile · SIEM Integration
• Log Forwarding · Log Forwarding Add Form
• WEB-CLI · settings log-transport

Related questions

• Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?
• How long are logs kept on the device?
• Can I send flow data with IPFIX?