---
title: 'Log streaming: Syslog'
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/logging-endpoints/protocol-based-and-self-hosted/log-streaming-syslog
---

Fastly's [Real-Time Log Streaming](https://www.fastly.com/documentation/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features) feature can send log files to syslog-based logging software. Syslog is a widely used standard for message logging.

> **NOTE:** 
>
> Fastly does not provide direct support for third-party services. Read [Fastly's Terms of Service](https://www.fastly.com/terms) for more information.
>
>

## Adding syslog as a logging endpoint

Follow these instructions to add syslog as a logging endpoint:

### Cdn Services

1.   Review the information in our guide to [setting up remote log streaming](/guides/integrations/streaming-logs/setting-up-remote-log-streaming).

2. In the Syslog area, click **Create endpoint**.
3. Fill out the **Create a Syslog endpoint** fields as follows:
   -   In the **Name** field, enter a human-readable name for the endpoint.

   -   In the **Placement** area, select where the logging call should be placed in the generated VCL. Valid values are **Format Version Default** and **None**. Read our guide on [changing log placement](/guides/integrations/streaming-logs/changing-log-placement) for more information.

   -   In the **Log format** field, optionally enter an Apache-style string or VCL variables to use for log formatting. Consult the [example format section](#example-format) for details.

   - In the **Syslog address** field, enter the domain name or IP address and port to which logs should be sent. Be sure this port can receive incoming TCP traffic from Fastly. See the [firewall considerations](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/protocol-based-and-self-hosted/log-streaming-syslog#firewall-considerations) section for more information.
   - _(Optional)_ In the **Token** field, enter a string prefix (line prefix) to send in front of each log line.
     > **IMPORTANT:** To send a token, be sure the [log line format](https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats) is set to a format other than **Blank**.
   - From the **TLS** menu, select **No** to disable encryption for the syslog endpoint, or **Yes** to enable it. When you select Yes, additional TLS fields appear.
   -   In the **TLS hostname** field, optionally enter a hostname to verify the logging destination server's certificate. This should be one of the Subject Alternative Name (SAN) fields for the certificate. Common Names (CN) are not supported.

   - _(Optional)_ In the **TLS CA certificate** field, copy and paste the certification authority (CA) certificate used to verify that the origin server's certificate is valid. The certificate you upload must be in PEM format. Consider uploading the certificate if it's not signed by a well-known certification authority. This value is not required if your TLS certificate is signed by a well-known authority. This field only appears when you select Yes from the Use TLS menu.
   - _(Optional)_ In the **TLS client certificate** field, copy and paste the TLS client certificate used to authenticate to the origin server. The TLS client certificate you upload must be in PEM format and must be accompanied by a client certificate. A TLS client certificate allows your server to authenticate that Fastly is performing the connection. This field only appears when you select Yes from the Use TLS menu.
   - _(Optional)_ In the **TLS client key** field, copy and paste the TLS client key used to authenticate to the backend server. The TLS client key you upload must be in PEM format and must be accompanied by a TLS client certificate. A TLS client key allows your server to authenticate that Fastly is performing the connection. This field only appears when you select Yes from the Use TLS menu.
4. _(Optional)_ To change the log line format, click **Advanced options**. 

   In the **Select a log line format** area, select the log line format for your log messages. Our guide on [changing log line formats](/guides/integrations/streaming-logs/changing-log-line-formats) provides more information.

    This must be compatible with your Syslog configuration.
5.   *(Optional)* In the **Period** field, enter an interval (in seconds) to control how frequently your log files are rotated. Rotation entails the finalization of one file object and the start of a new one, never removing any previously created file object. This value defaults to `3600` seconds.

6.   Click **Create** to create the new logging endpoint.

7.   From the **Activate** menu, select **Activate on Production** to deploy your configuration changes.

### Example format

The following is an example format string for sending data to syslog. Our discussion of [format strings](https://www.fastly.com/documentation/guides/integrations/streaming-logs/custom-log-formats) provides more information.

```plaintext
{
  "timestamp": "%{strftime(\{"%Y-%m-%dT%H:%M:%S%z"\}, time.start)}V",
  "client_ip": "%{req.http.Fastly-Client-IP}V",
  "geo_country": "%{client.geo.country_name}V",
  "geo_city": "%{client.geo.city}V",
  "host": "%{if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host)}V",
  "url": "%{json.escape(req.url)}V",
  "request_method": "%{json.escape(req.method)}V",
  "request_protocol": "%{json.escape(req.proto)}V",
  "request_referer": "%{json.escape(req.http.referer)}V",
  "request_user_agent": "%{json.escape(req.http.User-Agent)}V",
  "response_state": "%{json.escape(fastly_info.state)}V",
  "response_status": %{resp.status}V,
  "response_reason": %{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V,
  "response_body_size": %{resp.body_bytes_written}V,
  "fastly_server": "%{json.escape(server.identity)}V",
  "fastly_is_edge": %{if(fastly.ff.visits_this_service == 0, "true", "false")}V
}
```

### Adding separators or static strings

To insert a separator or other arbitrary string into the syslog endpoint format:

1. Create a [new header](https://www.fastly.com/documentation/guides/full-site-delivery/headers/adding-or-modifying-headers-on-http-requests-and-responses) with the following fields:
   - From the **Type** menu, select **Request**, and from the **Action** menu, select **Set**.
   - In the **Destination** field, enter any suitable header name (for example, `http.X-Separator`).
   - In the **Source** field, enter any special character or string you want (for example, `"|"` ).
2. Reference the new header variable in the log format box for your specific provider (for example, `req.http.X-Separator`).

### Compute Services

1.   Review the information in our guide to [setting up remote log streaming for Compute](/guides/integrations/streaming-logs/setting-up-remote-log-streaming-for-compute). Additionally, our developer documentation provides more [information about logging](/guides/integrations/non-fastly-services/developer-guide-logging/) with Compute code written in our [supported languages](/reference/compute/sdks/).

2. In the Syslog area, click **Create endpoint**.
3. Fill out the **Create a Syslog endpoint** fields as follows:
   -   In the **Name** field, enter the endpoint name you specified in your Compute code. For example, in our [Rust code example](/guides/compute/developer-guides/rust/#logging), the name is `my_endpoint_name`.

   - In the **Syslog address** field, enter the domain name or IP address and port to which logs should be sent. Be sure this port can receive incoming TCP traffic from Fastly. Check out the [firewall considerations](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/protocol-based-and-self-hosted/log-streaming-syslog#firewall-considerations) section for more information.
   - _(Optional)_ In the **Token** field, enter a string prefix (line prefix) to send in front of each log line.
     > **IMPORTANT:** To send a token, be sure the [log line format](https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats) is set to a format other than **Blank**.
   - From the **TLS** menu, select **No** to disable encryption for the syslog endpoint, or **Yes** to enable it. When you select Yes, additional TLS fields appear.
   -   In the **TLS hostname** field, optionally enter a hostname to verify the logging destination server's certificate. This should be one of the Subject Alternative Name (SAN) fields for the certificate. Common Names (CN) are not supported.

   - _(Optional)_ In the **TLS CA certificate** field, copy and paste the certification authority (CA) certificate used to verify that the Syslog server's certificate is valid. The certificate you upload must be in PEM format. Consider uploading the certificate if it's not signed by a well-known certification authority. This value is not required if your TLS certificate is signed by a well-known authority. This field only appears when you select Yes from the Use TLS menu.
   - _(Optional)_ In the **TLS client certificate** field, copy and paste the TLS client certificate used to authenticate Fastly to the Syslog server. The TLS client certificate you upload must be in PEM format and must be accompanied by a client key. A TLS client certificate allows your Syslog server to authenticate that Fastly is performing the connection. This field only appears when you select Yes from the Use TLS menu.
   - _(Optional)_ In the **TLS client key** field, copy and paste the TLS client key used to authenticate Fastly to the Syslog server. The TLS client key you upload must be in PEM format and must be accompanied by a TLS client certificate. A TLS client key allows your Syslog server to authenticate that Fastly is performing the connection. This field only appears when you select Yes from the Use TLS menu.
4. _(Optional)_ To change the log line format, click **Advanced options**. 

   In the **Select a log line format** area, select the log line format for your log messages. Our guide on [changing log line formats](/guides/integrations/streaming-logs/changing-log-line-formats) provides more information.

    This must be compatible with your Syslog configuration.
5.   Click **Create** to create the new logging endpoint.

6.   From the **Activate** menu, select **Activate on Production** to deploy your configuration changes.

### Recommended log format

Log messages can take on any format you choose because the log line format selected above will affect the overall line sent to and parsed by Syslog.

## Syslog facility and severity

The syslog output includes the following facility and severity values:

```term nolinenums
facility: local0
severity: info
```

## Firewall considerations

Syslog has limited security features. For this reason, it's best to create a firewall for your syslog server and only accept TCP traffic on your configured port from our address blocks. Our list of IP address blocks is dynamic, so we recommend [programmatically obtaining the list](https://www.fastly.com/documentation/reference/api/utils/public-ip-list/) whenever possible.

## Related content

- [API reference: Syslog log streaming](https://www.fastly.com/documentation/reference/api/logging/syslog/)
- [CLI reference: Syslog log streaming](https://www.fastly.com/documentation/reference/cli/logging/syslog/)