Skip to main content

​
Set up

Remote syslog requires 3CX V20 Update 9 or later.
  1. Follow the shared Log Forwarders guide to add 3CX and open Forwarder Details (or ask Chat for the listener ip:port)
  2. In the 3CX Admin Console, go to Integrations > Remote Syslog and set Remote Logging Provider to Custom Syslog Server. See the 3CX guide Custom Syslog Server
  3. Enter the host from Forwarder Details in Syslog Server Address and its port in Port, then set Transport Protocol to match its transport (UDP, TCP, or TLS)
  4. Under Data to Export, enable System Alerts, 3CX Alerts, and Audit Logs, then click Save. System Alerts are sent only when alert thresholds are configured under System > Alerts
  5. Click Test at the top of the page. The test message appears in Wirespeed with the log kind SyslogIntegrationTest
  6. Events will begin showing up shortly
If Forwarder Details shows TLS: Enabled, 3CX must trust Wirespeed’s certificate before it can connect. See Syslog over TLS.

​
Parsed events

3CX tags each record with a log kind: EventLog, AuditLog, Telemetry, or SyslogIntegrationTest (any other kind is stored as other). 3CX Alerts arrive as EventLog and Audit Logs as AuditLog. JSON bodies are split into fields, and keys without a dedicated field are kept in unmapped. A body that isn’t JSON, such as the test message, is stored as the message. Event and audit logs carry these fields:
  • Event log: the message, template and parameters, the source service, the numeric event type, the event ID, and the group. For unidentified incoming calls, the SIP request method, source address, and User-Agent are extracted from the embedded INVITE. IPs that 3CX blocklists are recorded as the event’s source address.
  • Audit log: the action, the object type and name, the username, the client IP, and the previous and new values. User Login records are normalized as sign-ins, and Impersonate User records are marked as an admin action.
Wirespeed detects RFC 5424 (the 3CX default) and RFC 3164 framing automatically.