Forwarding Logs to a Syslog Server

Requirements: CoreSSH Server

CoreSSH Server can forward its log messages to an external syslog collector over UDP, which is useful for centralizing logs from multiple servers into a SIEM or log management platform. This guide covers configuring syslog forwarding.

Enabling Syslog Forwarding

Syslog forwarding is configured in the Logging section of the Settings page, alongside the local file logging options.

Enable the Enable Syslog checkbox, then enter the hostname or IP address of your syslog collector in Syslog Host and its listening port in Syslog Port. The standard syslog UDP port is 514. After applying these settings, click Save Settings.

Syslog forwarding runs independently of the Write Log to a File option — you can forward to syslog with or without also writing logs to a local file.

Choosing a Local Interface

By default, the operating system automatically selects which local network interface and port are used to send syslog messages. To pin these explicitly (for example, on a multi-homed server), set Syslog Local Host and Syslog Local Port.

Message Format

Forwarded messages are tagged with facility code 16 (local use 0). The severity of each message is derived from its log level: errors are sent as Error severity, warnings as Warning severity, informational entries as Informational severity, and verbose/debug entries as Debug severity. To include more detail in forwarded messages, increase the Log Mode setting (see Enabling Verbose Logging for Troubleshooting).