> For the complete documentation index, see [llms.txt](https://docs.verge.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.verge.io/knowledge-base/troubleshooting/configuring-remote-log-forwarding.md).

# Configuring Remote Log Forwarding (Syslog)

VergeOS can be configured to forward logs to a remote Syslog server, an important capability for organizations leveraging log aggregation for centralized management, log archival, and compliance.

{% hint style="success" %}
**Log Retention**

Logged activity is typically available within the VergeOS user interface for a maximum of **45 days**. Configure remote log forwarding to retain logs for longer periods.
{% endhint %}

## Prerequisites

* Network connectivity between VergeOS and the remote syslog server
* Appropriate firewall rules to allow syslog traffic (typically port 514)
* Access to VergeOS System Settings

## Configuration Steps

To configure log forwarding to a remote syslog server:

### 1. Navigate to Advanced Settings

Navigate to **System > Settings > Advanced Settings**.

### 2. Configure the Remote Syslog Server

1. Under the "Setting" column heading, type `syslog` and press **Enter** to search
2. Select and edit **Remote syslog server (tcp: @@name/ip:port, udp: @name/ip:port)**
3. Configure this setting according to the syntax expected by your remote server:

{% hint style="info" %}
**Server Configuration Examples**

* **For TCP:** `@@10.10.10.10:514`
* **For UDP:** `@10.10.10.10:514`
  {% endhint %}

{% hint style="info" %}
**Choosing TCP or UDP**

* **TCP (`@@`)** provides guaranteed delivery; use it for audit and compliance logging.
* **UDP (`@`)** is fire-and-forget: lower overhead, but messages can drop under load.
  {% endhint %}

{% hint style="info" %}
**Collector Port**

Listening on port 514 requires root privileges on the collector. Many collectors run unprivileged (for example, in containers) and listen on port **1514** instead. Enter the port your collector listens on.
{% endhint %}

4. Click **Submit** at the bottom of the page to save

### 3. Configure the Format Template

1. Search for `syslog` again in the settings
2. Select and edit **Template to define for syslog server (See rsyslog for format)**
3. Enter a syslog template format that is compatible with your remote syslog server

{% hint style="info" %}
**Template Example**

```plaintext
   RFC5424,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME%.your-hostname-here %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
```

{% endhint %}

{% hint style="warning" %}
Use the literal `1` after `<%PRI%>` — it is the RFC 5424 version field. Do not use `%PROTOCOL-VERSION%`: it renders as `0` on the wire, and strict RFC 5424 collectors (Promtail/Loki, Fluent Bit, modern Graylog) reject version 0 with parse errors.
{% endhint %}

{% hint style="info" %}
Replace `your-hostname-here` with your actual hostname, or leave as `.HOSTNAME_HERE` to use the default system hostname.
{% endhint %}

{% hint style="info" %}
**Forwarding from Multiple VergeOS Systems**

`%HOSTNAME%` resolves to the bare node name (`node1`, `node2`), which is ambiguous when several VergeOS systems forward to the same collector. Common hostname patterns:
{% endhint %}

| Pattern                            | Example output                | Use                                                   |
| ---------------------------------- | ----------------------------- | ----------------------------------------------------- |
| `%HOSTNAME%`                       | `node1`                       | A single system                                       |
| `mycluster-%HOSTNAME%`             | `mycluster-node1`             | A prefix per system; recommended for multiple systems |
| `%HOSTNAME%.mycluster.example.com` | `node1.mycluster.example.com` | FQDN style                                            |

4. Click **Submit** at the bottom of the page to save the format

## Collector Notes

The RFC 5424 template above works with common collectors:

| Collector     | Configuration notes                                                                              |
| ------------- | ------------------------------------------------------------------------------------------------ |
| Graylog       | Use a **Syslog TCP** or **Syslog UDP** input.                                                    |
| Loki          | Use a Promtail `syslog` scrape job; Promtail requires strict RFC 5424 (the literal `1` version). |
| Splunk        | Use a TCP or UDP data input, or Splunk Connect for Syslog.                                       |
| Elasticsearch | Ingest through Logstash with the `syslog` input plugin.                                          |
| rsyslog relay | Use a standard `imtcp` or `imudp` listener.                                                      |

## Additional Resources

For more information on syslog templates and formatting options, visit the [Rsyslog Documentation](https://www.rsyslog.com/doc/master/configuration/examples.html).

## Verification

After you save the configuration, VergeOS begins forwarding logs to the specified server. Check the collector to confirm VergeOS logs arrive.

If logs do not arrive:

1. On the collector host, capture traffic on the configured syslog port to confirm packets arrive (replace `514` with the port you configured):

   ```bash
   tcpdump -i any -A port 514
   ```
2. Inspect the captured messages to verify the wire format. An RFC 5424 message starts with `<PRI>1` (for example, `<30>1 2026-04-15T...`); a version of `0` means the template still uses `%PROTOCOL-VERSION%` — see the template warning above.
3. Make sure firewall rules between VergeOS and the collector allow the configured port and protocol.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.verge.io/knowledge-base/troubleshooting/configuring-remote-log-forwarding.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.