Configure Syslog server settings

You can send logs, audit records, and alerts from the NDR to external Syslog servers. This allows security teams to centralize log and alert data and supports the configuration of multiple Syslog destinations.

Configure Syslog servers via the CLI

Prerequisites

You must have the IP address and port details for your destination Syslog servers.

Log in to the NDR as npadmin using the NDR IP address:
```
$ ssh npadmin@10.1.0.1
```
Enter privileged mode:
```
npadmin@ndr> enable
```
Enter the npadmin password:
```
[sudo] password for npadmin: <password>
```
Enter configuration mode:
```
npadmin@ndr# configure system
```
Enter the syslog configuration menu:
```
npadmin@ndr(config)# syslog
```

The Syslog configuration menu appears:

1: Enable log shipping = False

2: Logging level = info

3: Logging target(s) = 10.1.2.1:612

4: Logging export protocol = tcp

5: Enable TLS = False

6: Enable audit log shipping = False

7: Alert export
--------------------

Q: Save changes and exit

C: Cancel changes and exit

Select which option you would like to change using the index number.

Configure the following options:

Option	Description
Enable log shipping	Enter `1` to set it to True if you want to transfer the logs to the Syslog server. It is set to False by default.
Log level	Enter `2` to set the minimum severity of logs to export. The available severity levels are - Emergency, Alert, Critical, Warning, Error, Notice, Info, and Debug. Note The default level is Info.
Logging target	Enter `3` to configure the Destination IP address and port for the server. The port configuration is optional. If you do not specify a port, syslog exports over the standard port 514. To configure multiple syslog servers, separate each `<IPaddress>:<port>` entry with a space.
Logging export protocol	Enter `4` to configure the export protocol to either TCP or UDP for transport.
Enable TLS	Enter `5` to configure TLS encryption. Before you complete the configuration, ensure that you generate the Syslog certificates and upload the client certificate to syslog collection. For more information, see Enabling TLS encryption for syslog.
Enable audit log shipping	Enter `6` to enable the export of system audit logs to the Syslog server. It is set to False by default.
Alert export	Enter `7` to configure Syslog server(s) to transfer alerts. To configure multiple syslog servers, separate each `<IPaddress>:<port>` entry with a space.

Enter Q to save the configuration changes; C to cancel.