---
title: Setting up remote log streaming
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/streaming-logs/setting-up-remote-log-streaming
---


Fastly's [Real-Time Log Streaming feature](/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features) allows you to automatically save logs to a third-party service for storage and analysis. Logs provide an important resource for troubleshooting connectivity problems, pinpointing configuration areas that could use performance tuning, and identifying the causes of service disruptions. We recommend setting up remote log streaming when you start using Fastly services.

> **NOTE:** <Partial name='third-party-support' inline />

## Before you begin

Before setting up remote log streaming, keep the following in mind:

* Be sure to double-check the delivery formats required by your logging provider and what you're delivering to them. Some providers have strict formatting requirements for the formats they allow (e.g., JSON).
* If you configure multiple logging endpoints for your service, logs will be sent to all of the logging endpoints.

> **IMPORTANT:** <Partial name='gdpr-logging-privacy' inline />

## Configuring logging endpoints

You can configure one or more logging endpoints for Fastly services. Follow these instructions to access the logging settings:

1. <Partial name='step-login' inline />
1. <Partial name='step-select-service' inline />
1. <Partial name='step-click-edit' inline />
1. Click **Logging**. The logging endpoints page appears. If you've already added a logging endpoint, click **Create Endpoint**.

   ![the logging endpoints page](/img/choose-logging-endpoints.png)

1. Follow the instructions in one of our [logging endpoint guides](/guides/integrations/logging-endpoints) to complete the set up process and deploy your changes.

Once you've clicked Activate to deploy your changes, events will begin being logged immediately. The logs may take a few moments to appear on your log server.

## How, when, and where logs are streamed

To control log streaming, Fastly provides [two versions of custom log formats](/guides/integrations/streaming-logs/custom-log-formats), each of which uses [Apache-style logging directives](https://httpd.apache.org/docs/2.4/mod/mod_log_config.html). The logging format strings in each of these versions are based on the [Common Log Format](https://httpd.apache.org/docs/trunk/logs.html#common) (CLF).

Logs are streamed over TCP, not UDP, optionally using TLS for security with supported endpoints. Additionally, if you are using [custom VCL](/guides/full-site-delivery/fastly-vcl/about-fastly-vcl) be sure to include the [`#FASTLY log`](/reference/vcl/subroutines/log/) macro in your `vcl_log` handler.

By default, logs are placed in your root directory every hour using the file naming format `YYYY-mm-ddThh:mm:ss-<uid>`. You can change both the frequency and path of these files. Our guide on [changing where log files are written](/guides/integrations/streaming-logs/changing-where-log-files-are-written) provides more information.

If you've configured multiple logging endpoints for your service, the logs will be sent to all of the logging endpoints.

Fastly uses several different log-server aggregation points and each will send logs files, none of which contain duplicate entries. These log files are created as soon as streaming starts and they're written to over the entire time period you specify (or the default). Once that time has passed, the files aren't touched any more and the logging process creates a new batch of files.

The number of log-server aggregation points may change over time in line with our capacity requirements. If you're sending logs to a storage endpoint and are concerned about the number of log files that will be created on your disk, consider choosing a [logging endpoint](/guides/integrations/logging-endpoints) that supports real-time ingestion, which will eliminate a need for pre-processing log files.

## Escaping characters in logs

Logs respond to [VCL](/guides/full-site-delivery/fastly-vcl/about-fastly-vcl) like any other object. For example, the following code can escape quotes from User-Agent your log stream:

```plain
log {"syslog serviceid endpointname :: "} {"""} cstr_escape(req.http.user-agent);
```

## Preventing duplicate log entries when using custom VCL

If you use [custom VCL](/guides/full-site-delivery/fastly-vcl/about-fastly-vcl) commands for logging, you may notice duplicate entries in your logs. This happens because logs are being generated by both Fastly and the custom VCL logging commands. You can eliminate the duplicate entries by following these steps:

1. On the [Logging endpoints page](#configuring-logging-endpoints), click the name of the logging endpoint you want to edit.
1. From the **Placement** menu, select **None**.
1. Click **Update**.
1. <Partial name='step-activate-deploy' inline />

Fastly will stop generating log entries, and your logs will only contain entries generated by the custom VCL logging commands.

## Troubleshooting common logging errors

When your logging configuration displays errors, use the Endpoint Error Stream to [investigate and diagnose the problem](/guides/integrations/streaming-logs/troubleshooting-logging-endpoints/).

## Related content

* [About Fastly's Real-Time Log Streaming features](/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features)
* [Setting up remote log streaming for Compute](/guides/integrations/streaming-logs/setting-up-remote-log-streaming-for-compute)
* [API reference: Remote logging](/reference/api/logging/)
* [Apache's logging directives](https://httpd.apache.org/docs/2.4/mod/mod_log_config.html)