Skip to main content

​
Set up

  1. Follow the shared Log Forwarders guide to add Zscaler ZPA (Syslog) and open Forwarder Details
  2. Login to the ZPA Admin Portal
  3. Navigate to Configuration & Control > Private Infrastructure > Log Streaming Service > Log Receivers
  4. Click Add Log Receiver and configure the Log Receiver tab:
    1. Name: A descriptive name (e.g., “Wirespeed”)
    2. Domain or IP Address: Hostname or IP from Forwarder Details
    3. TCP Port: Listener port from Forwarder Details
    4. App Connector Groups: Select the groups whose logs you want to forward
  5. Click Next and configure the Log Stream tab:
    1. Log Type: Select the desired log type (e.g., User Activity, Browser Access)
    2. Log Template: Select JSON
    3. Log Stream Content: Use the default template
  6. Click Save
ZPA logs should reflect shortly underneath the Events page.
Zscaler ZPA sends logs via App Connectors, not directly from the ZPA cloud. Ensure the selected App Connector Groups have network connectivity to the Wirespeed hostname and port.