How to configure syslog on a Ubiquiti UniFi controller

Configure UniFi to forward syslog messages to Auvik for centralized event collection and troubleshooting.

Before you begin

Ensure the following prerequisites are met:

• The date, time, and timezone are correctly configured on your UniFi controller and managed devices.
• You have administrator access to the UniFi Network application.
• The IP address of your Auvik collector is known. You can find it in Syslog > Summary under the Export Information column.
• Network connectivity exists between the UniFi devices and the Auvik collector.
• Firewalls or ACLs allow syslog traffic (UDP 514) from UniFi devices to the collector.

Note: UniFi devices send syslog messages directly to the configured syslog server. The UniFi controller distributes the configuration but does not proxy or forward the logs on behalf of the devices. Ensure the collector is reachable from the UniFi devices themselves.

Configure syslog

The location of the syslog settings may vary slightly depending on your UniFi Network application version.

UniFi Network Application 8.x and earlier

1. Log in to the UniFi Network application.
2. Click Settings (gear icon).
3. Under Site, locate Remote Logging.
4. Enable Remote Syslog Server.
5. Leave Enable Debug Logging disabled unless directed by Auvik Support.
6. Enter the IP address of your Auvik collector.
7. Enter 514 as the port number.
8. Click Apply Changes.

UniFi Network Application 9.x and later

1. Log in to the UniFi Network application.
2. Navigate to Settings.
3. Open Integrations or Control Plane settings (depending on your UniFi version).
4. Under Activity Logging (Syslog), enable SIEM Server.
5. Enter the IP address of your Auvik collector.
6. Enter 514 as the port number.
7. Leave debug logging disabled.
8. Click Apply Changes.

Verify syslog forwarding

After configuration:

1. Generate activity within the UniFi environment (for example, log in to the controller or make a configuration change).
2. Wait several minutes for logs to be forwarded.
3. In Auvik, navigate to Syslog > Summary.
4. Confirm that logs are being received from the UniFi devices.

Troubleshooting

If logs are not appearing in Auvik, verify the following:

• The collector IP address is correct.
• UDP port 514 is allowed between the UniFi devices and the Auvik collector.
• The UniFi devices can route to the collector.
• The devices have successfully received the remote logging configuration.
• The system time and timezone are configured correctly.
• No firewall, VPN, or NAT policy is blocking syslog traffic.

If you're using multiple UniFi sites, confirm that remote logging has been configured for each site as required.

Additional considerations

• Debug logging is not recommended for normal operation because it can significantly increase log volume.
• Syslog forwarding applies to all adopted UniFi devices within the configured site.
• Depending on the UniFi version, available log categories and logging options may vary.