---
title: Syslog
metaTitle: "Syslog Server Integration for Log Collection | OpenObserve"
description: "Configure syslog server integration to collect system, server, and network device logs over TCP or UDP with OpenObserve for centralized logging."
---

# Syslog Server - System & Network Log Collection

:::warning[Deprecation Notice]
Built-in Syslog ingestion (via TCP/UDP on port 5514) has been **deprecated as of August 2025** and is no longer available in OpenObserve.

**Recommended alternatives:**

- [AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-destinations/openobserve/)
- [syslog-ng](https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-openobserve-using-syslog-ng)
- [Vector](../logs/vector.md)
- [Fluent Bit](../logs/fluent-bit.md)

We suggest using **AxoSyslog or syslog-ng** if you want protocol-native support for Syslog.
:::

:::accordion[Legacy reference (pre-August 2025)]

The configuration below is preserved for historical context. Use one of the alternatives above for new deployments.


OpenObserve can act as a syslog server. This means that you can send logs to OpenObserve using the syslog protocol. OpenObserve supports both UDP and TCP syslog.

## Enable syslog

Before you can send logs to OpenObserve, you need to enable OpenObserve to act as a syslog server. This is done by enabling syslog in the `Ingestion > Logs > Syslog` section of the OpenObserve UI.

![Enable syslog](./images/syslog.png)

## Subnets to allow traffic from

OpenObserve will only accept syslog traffic from the subnets that you specify. You must specify a minimum of 3 things:

- Organization
- Stream name
- Subnets

## Configuration

Default port: `5514`

You can change the default port number using the following environment variables:

- `ZO_TCP_PORT` - TCP port number to listen on. Default: `5514`
- `ZO_UDP_PORT` - UDP port number to listen on. Default: `5514`

You can also configure the TLS settings for syslog TCP server using the following environment variables:

- `ZO_TCP_TLS_ENABLED` - Enable TLS for TCP syslog server. If enabled, `ZO_TCP_PORT` will be used for the TLS connection over TCP. Default: `false`

If `ZO_TCP_TLS_ENABLED` is set to `true`, then ensure all the below variables are set:

- `ZO_TCP_TLS_CERT_PATH` - Path to the TLS certificate file to be used on the server.
- `ZO_TCP_TLS_KEY_PATH` - Path to the TLS key file to be used on the server.
- `ZO_TCP_TLS_CA_CERT_PATH` - Path to the TLS CA certificate file to be used on the server.

## Testing

Select an organization and stream. Then set the subnet to `0.0.0.0/0`. This config allows accepting syslog data from any IP address.

You can then use the syslog generator script from [this repo](https://github.com/openobserve/syslog_log_generator) to test if you are able to accept syslog data in OpenObserve.

Steps:

### Clone the repo

```bash
git clone https://github.com/openobserve/syslog_log_generator
cd syslog_log_generator
```

### Modify the script

file `generate_logs.sh`

```bash
#!/bin/sh
python syslog_gen.py --host 127.0.0.1 --port 5514 --file sample_logs.txt --count 1000
```

Modify the file with the appropriate IP address.

### Start generating test syslog data

```bash
./generate_logs.sh
```
:::


**Need some help?**

- Join our [Community Slack](https://short.openobserve.ai/community) 
- Or [Contact support](https://openobserve.ai/contactus/)