> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# 3CX

> Forward event log and audit log syslog from the 3CX phone system

## Set up

Remote syslog requires 3CX V20 Update 9 or later.

1. Follow the shared [Log Forwarders](https://docs.wirespeed.co/integrations/log-forwarders.md) guide to add **3CX** and open **Forwarder Details** (or ask Chat for the listener `ip:port`)
2. In the 3CX Admin Console, go to **Integrations** > **Remote Syslog** and set **Remote Logging Provider** to **Custom Syslog Server**. See the 3CX guide [Custom Syslog Server](https://www.3cx.com/docs/custom-syslog-server/)
3. Enter the host from **Forwarder Details** in **Syslog Server Address** and its port in **Port**, then set **Transport Protocol** to match its transport (UDP, TCP, or TLS)
4. Under **Data to Export**, enable **System Alerts**, **3CX Alerts**, and **Audit Logs**, then click **Save**. System Alerts are sent only when alert thresholds are configured under **System** > **Alerts**
5. Click **Test** at the top of the page. The test message appears in Wirespeed with the log kind `SyslogIntegrationTest`
6. Events will begin showing up shortly

If **Forwarder Details** shows **TLS: Enabled**, 3CX must trust Wirespeed's certificate before it can connect. See [Syslog over TLS](https://docs.wirespeed.co/integrations/log-forwarders.md#syslog-over-tls).

## Parsed events

3CX tags each record with a log kind: `EventLog`, `AuditLog`, `Telemetry`, or `SyslogIntegrationTest` (any other kind is stored as `other`). **3CX Alerts** arrive as `EventLog` and **Audit Logs** as `AuditLog`. JSON bodies are split into fields, and keys without a dedicated field are kept in `unmapped`. A body that isn't JSON, such as the test message, is stored as the message. Event and audit logs carry these fields:

* **Event log**: the message, template and parameters, the source service, the numeric event type, the event ID, and the group. For unidentified incoming calls, the SIP request method, source address, and User-Agent are extracted from the embedded INVITE. IPs that 3CX blocklists are recorded as the event's source address.
* **Audit log**: the action, the object type and name, the username, the client IP, and the previous and new values. `User Login` records are normalized as sign-ins, and `Impersonate User` records are marked as an admin action.

Wirespeed detects RFC 5424 (the 3CX default) and RFC 3164 framing automatically.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.