> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Generic Syslog Logs

> Ingest Syslog logs from any source within your organization

Wirespeed can ingest Syslog logs from any source within your organization. Email addresses, IPs, and important dates are automatically identified and extracted. If you would like additional information extracted, please use the Chat button on the left-hand navigation and talk with our support team.

1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select Generic Syslog and click **Integrate**
3. After you have clicked Integrate, select **Chat** on the left-hand navigation and ask the support team to provide you with an `ip:port` combination to provide to your source application
4. Events will begin showing up shortly

## Understanding IP:Port

When you set up a syslog integration, Wirespeed provides you with an **IP address** and a **port number** (e.g., `203.0.113.10:12345`). The IP address is the Wirespeed endpoint your devices will send logs to, and the **port** is how Wirespeed identifies which service or vendor the incoming logs belong to.

You can think of each port as corresponding to a **vendor** or **service**. When logs arrive on a given port, Wirespeed knows which integration they belong to and displays them under the correct vendor name in the **Events** tab.

### When do I need multiple ports?

**Different vendors or services** require separate ports. For example, if you have both a SonicWall firewall and a Cisco Meraki deployment, each would get its own `ip:port` so they appear as distinct vendors in Events.

**Multiple devices of the same vendor** can typically share a single port. For example, if you have several FortiGate firewalls (active-active pairs, active-passive pairs, etc.) all sending FortiGate syslog, they can all target the **same** `ip:port`. The logs will appear under a single vendor entry in Events, and you can filter by device name, source IP, or other identifiers within the logs to distinguish between individual appliances.

<Tip>If you have distinct groups of the same vendor that you'd like to track separately (e.g., firewalls in different regions), you can optionally request separate ports for each group. To do this, add another **Generic Syslog** integration via Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) and request a new `ip:port` from the support team. Each additional integration gets its own port, giving you separate vendor entries in the Events tab for easier filtering. However, this is not required — a single port works fine as long as the logs contain identifiers like device name or IP address.</Tip>