Skip to main content
This page covers syslog from the Sophos Firewall appliance (SFOS). For Sophos Central endpoint detections, see Sophos Central.

​
Set up

  1. Follow the shared Log Forwarders guide to add Sophos Firewall and open Forwarder Details (or ask Chat for the listener ip:port). Sophos sends syslog over UDP, or over TLS when secure log transmission is on. It can’t send to a plain TCP listener
  2. In the Sophos Firewall web admin console, go to System services > Log settings and click Add in the Syslog servers section. You can add up to five syslog servers
  3. Enter a Name, and set IP address/domain and Port to the values from Forwarder Details
  4. If Forwarder Details shows TLS: Enabled, turn on Secure log transmission. Otherwise leave it off, and the firewall sends over UDP
  5. Set Format to Standard syslog protocol (called Central Reporting Format on SFOS 19.0). The legacy Device standard format is also parsed
  6. Set Facility to DAEMON and Severity level to Information, then click Save
  7. On Log settings, find the column for the new syslog server, select every log type in it (Wirespeed parses each of them), and click Apply
  8. Events will begin showing up shortly
If Forwarder Details shows TLS: Enabled, enter Wirespeed’s listener as a domain name. The firewall checks that the certificate’s Common Name (or, with LINCE mode on, its Subject Alternative Name) matches that domain. See Syslog over TLS.

​
Time zones

The standard syslog protocol sends timestamp with its UTC offset. The legacy device format sends date and time in the firewall’s local time with a time zone abbreviation (for example timezone="CEST"). Use the standard syslog protocol to avoid time zone offsets.

​
Parsed events

Wirespeed parses firewall rule, content filtering (web and SSL/TLS inspection), application control, IPS, ATP, anti-malware, anti-spam, VPN, and system events into dedicated fields keyed by log_type, log_component, and log_subtype. Web admin and SSH console logins, as well as firewall, VPN, and user portal authentication events, are normalized as sign-ins. Fields without a dedicated column are kept in unmapped.