Forward to Syslog Server
Forward to Syslog Server sends matching stored messages to another syslog collector or SIEM.
| The feature reads messages from syslog storage, not from the collector as they arrive. The collector keeps writing to storage even if this feature is slow, suspended, or failing — storage acts as a large buffer so collection is not blocked. |
Common Feature, Data Fields, and Filter settings are described in Managing Features. This page covers the Syslog Forwarder section.
Destination
| Setting | Description |
|---|---|
Target server |
IPv4, IPv6, or hostname of the syslog server to send to. Required. |
Target port |
Destination port. |
Use local interface (optional) |
Local IP to bind for outgoing packets. Blank = OS default route. |
Protocol |
Outbound transport: UDP, TCP, or TLS. |
Messages in stream |
How syslog messages are delimited on TCP and TLS. Octet counting or a separator. |
TLS Options
Visible for Syslog over TLS.
| Setting | Description |
|---|---|
Protocol version |
TLS protocol version for the outbound connection. |
Verify server certificate |
When verification is on, the peer certificate is checked against Windows trusted roots and the optional CA, and the name must match Target server. Verification is off by default so self-signed lab receivers keep working; turn it on for production. |
Certificate Authority (CA) |
Named CA from Manage Certificates. Blank = Windows trusted roots only. Used only when verify is on. |
Timeout |
Connect, handshake, and I/O timeout in milliseconds. |
Certificate |
Optional client certificate (named certificate from Manage Certificates) if the receiver requires mutual TLS. |
Private key password |
Password for a protected private key. |
Send Messages (Format)
Choose how to transform each message before sending: as stored, rebuild as RFC 5424 (optionally with origin structured data), or a custom template.
When the format is In custom format, simple mode uses a single Message template.
Example: <{PRIORITY}>{RAW_MESSAGE} — the message as received, including the syslog priority prefix.
Click Switch to Advanced Mode to define several Format Templates. Each template has:
-
a Template filter (blank = all messages that already passed the feature filter)
-
a Message template
Every matching template is applied, in listed order, and the results are concatenated into one forwarded syslog message.
| If no template matches, the forwarded payload is empty. |
The usual reason for several templates is originators that do not share one outbound format.
Several templates also cover a composite payload: optional parts that should appear only under certain conditions. Add a template per part; every matching part is included.