> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/administration/logging/syslog-export.md).

# Syslog Export

ExaVault Premium can send Activity records to a remote Syslog collector for ingestion by a security information and event management (SIEM) system or another logging platform. The stream contains user, administrator, authentication, and file Activity. It does not include the appliance service logs stored under `/data/exavault/logs/`.

## Configure Syslog

Open the Appliance Manager at `https://<your-appliance-hostname>:9002/`, then open the *Configuration* page. Enter the collector's address in *Syslog Host* and its listening port in *Syslog Port*. Save the configuration and restart the appliance from the Appliance Manager *Home* page.

ExaVault sends Syslog over UDP by default. When *Syslog Port* is `601`, ExaVault uses TCP instead. The connection is not protected with TLS, so keep the traffic on a trusted network or protect it with your network infrastructure. Configure the collector and any intervening firewall for the same transport and port.

Messages use the Syslog `FTP` facility.

## Activity Record Format

Each Activity record has this general shape:

```
[timestamp] <connection> <remote_ip> [(country)] <target> <action> <details> STATUS <result>
```

| Field        | Meaning                                                                                                                    |
| ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `timestamp`  | Appliance local time in `%d/%b/%Y:%H:%M:%S` format                                                                         |
| `connection` | Connection type, such as `Web (HTTPS)`, `FTP`, `FTPS`, `SFTP`, `WebDAV`, or `API (HTTPS)`                                  |
| `remote_ip`  | Source IP address for the activity                                                                                         |
| `country`    | Two-letter country code when GeoIP lookup succeeds                                                                         |
| `target`     | Object type, such as `PATH`, `USER`, `GROUP`, `SITE`, `BRAND`, `LINK`, `CONNECTOR`, `LOG`, `SHARE`, or `RULE`              |
| `action`     | Action such as `LOGIN`, `LOGOUT`, `WRITE`, `READ`, `REMOVE`, `CREATE`, `EDIT`, `MOVE`, `COPY`, `RESTORE`, or `MOVETOTRASH` |
| `details`    | Target-specific path, object, and acting-user information                                                                  |
| `result`     | `200 OK`, `400 WARNING`, or `500 ERROR`                                                                                    |

Path activity uses the following detail forms:

```
<path> BY <username> [SIZE <bytes>B]
```

Move and copy activity includes both locations:

```
FROM <source> TO <destination> BY <username> [SIZE <bytes>B]
```

The site root is removed from logged paths, spaces are represented with `+`, and an empty path is represented with `-`. User, group, site, brand, and Link records identify the modified object and the acting user when that information applies.

Example records:

```
[15/Sep/2026:11:38:44] Web (HTTPS) 192.0.2.10 (US) PATH WRITE /incoming/report.csv BY uploader SIZE 123B STATUS 200 OK
[15/Sep/2026:11:40:02] SFTP 192.0.2.11 (US) USER LOGIN BY transfer-user STATUS 200 OK
```

## Troubleshoot Missing Records

First confirm that the event appears in the web interface's Activity records. If it does not, investigate the underlying action before troubleshooting Syslog delivery.

When the Activity record exists but does not reach the collector, confirm that the site has the Premium feature, the host and port are correct, the collector is listening with the expected UDP or TCP transport, and the network permits traffic from the appliance. Review the `celery` files described in [Logging](/administration/logging.md) for forwarding errors, using the event time to correlate the records.