Syslog Server Overview and Configuration

Types of syslog messages 

Meraki devices send different categories of messages, called roles, depending on the product: 

• The MX Security Appliance sends four main roles: Event Log, IDS Security Alerts, URLs, and Flows. 

• MR Access Points send the same roles except IDS Security Alerts, and they add Air Marshal events. 

• MS Switches currently support only Event Log messages. 

If the syslog server sits across a VPN, the source IP is 6.X.X.X when no VLANs run in VPN mode, when the MX runs in passthrough mode, or when the MX runs in Routed/NAT Single LAN mode. 

Appliance/Switch/Wireless Event Log

The Event Log role sends a copy of the messages found in the Dashboard under Network-wide > Monitor > Event log. 

Example: May 10 18:46:04 192.168.10.1 1 948080570.911780502 MX60 events dhcp lease of ip 192.168.10.252 from server mac 00:18:0A:XX.XX.XX for client mac 58:67:1A:XX.XX.XX from router 192.168.10.1 on subnet 255.255.255.0 with dns 8.8.8.8, 8.8.4.4 

Summary: A client with MAC address 00:18:0A:XX.XX.XX leased an IP address from the MX, and the MX provided 8.8.8.8 and 8.8.4.4 as DNS servers to the client. 

Configure a syslog server on Linux 

The following commands show an example configuration on Ubuntu 13.04 using syslog-ng to gather syslog information from an MX Security Appliance. 

These commands are an example for demonstration. Refer to your server documentation for specific instructions. 

1. Install the syslog application: sysadmin@ubuntu:~$ sudo apt-get install syslog-ng 

2. Open the configuration file in an editor. This example uses nano: sysadmin@ubuntu:~$ sudo nano /etc/syslog-ng/syslog-ng.conf 

3. Choose one of the two logging options below. In this example, the MX LAN IP is 192.168.10.1 and the syslog server listens on 192.168.10.241, UDP port 514. Update these values to match your MX LAN IP and syslog server. Configure only one option. 

• Option 1 - Log all messages to /var/log/meraki.log:

#define syslog source
source s_net { udp(ip(192.168.10.241) port(514)); };

#create filter to match traffic (this filter will catch all syslog messages that come from the MX)
filter f_meraki { host( "192.168.10.1" ); };

#define a destination for the syslog messages
destination df_meraki { file("/var/log/meraki.log"); };

#bundle the source, filter, and destination rules together with a logging rule
log { source ( s_net ); filter( f_meraki ); destination ( df_meraki ); };

• Option 2 - Log different message types to individual log files: 

#define syslog source
source s_net { udp(ip(192.168.10.241) port(514)); };

#create individual filters to match each of the role categories
filter f_meraki_urls { host( "192.168.10.1" ) and match("urls" value ("MESSAGE")); };
filter f_meraki_events { host( "192.168.10.1" ) and match("events" value ("MESSAGE")); };
filter f_meraki_ids-alerts { host( "192.168.10.1" ) and match("ids_alerted" value ("MESSAGE")); };
filter f_meraki_flows { host( "192.168.10.1" ) and match("flows" value ("MESSAGE")); };

#define individual destinations for each of the role categories
destination df_meraki_urls { file("/var/log/meraki_urls.log"); };
destination df_meraki_events { file("/var/log/meraki_events.log"); };
destination df_meraki_ids-alerts { file("/var/log/meraki_ids-alerts.log"); };
destination df_meraki_flows { file("/var/log/meraki_flows.log"); };

#bundle the source, filter, and destination rules together with a logging rule for each role category
log { source ( s_net ); filter( f_meraki_urls ); destination ( df_meraki_urls ); };
log { source ( s_net ); filter( f_meraki_events ); destination ( df_meraki_events ); };
log { source ( s_net ); filter( f_meraki_ids-alerts ); destination ( df_meraki_ids-alerts ); };
log { source ( s_net ); filter( f_meraki_flows ); destination ( df_meraki_flows ); };

4. Restart the syslog-ng process: sysadmin@ubuntu:~$ sudo /etc/init.d/syslog-ng restart 

Configure the Dashboard 

1. Go to Network-wide > Configure > General. 

2. Select Add a syslog server to define a new server. 

3. Enter an IP address and UDP port number, and select the roles to send to the server. You can configure multiple syslog servers. 

4. Select Update syslog servers. 

Configure encrypted (TLS) syslog 

TLS encryption over TCP, defined in RFC 5425, secures syslog traffic sent over an insecure medium. 

1. Configure a syslog server, port, and TCP protocol. TLS encryption is only supported over TCP. 

2. Select TCP so you can check the Encrypted (TLS) syslog checkbox. 

3. Enable the Encrypted (TLS) syslog checkbox. 

Because encrypted syslog currently supports only MX Security Appliances, configure only Appliance Event log, Appliance Flows, and/or Appliance URLs for a server set to encrypted syslog. Add a separate syslog server entry for Switch or Wireless roles. 

Certificate authentication 

By default, the MX authenticates the syslog server's digital certificate using the Common CA Database ((CCADB). To use your own CA bundle: 

1. Upload your CA bundle on the Organization > Certificates page. 

2. Select Select a certificate next to the Enable checkbox for Encrypted (TLS) syslog and choose your uploaded bundle. 

If you do not upload and select a CA bundle for a given syslog server configuration, that configuration uses the CCADB certificate bundle to authenticate the server's digital certificate.

Troubleshooting Syslog  

If the syslog server is across a VPN, the source IP will be 6.X.X.X, provided no VLANs are in VPN mode, the MX is in passthrough mode, or the MX is in Routed/NAT Single LAN mode. 

Troubleshoot encrypted syslog connectivity

Encrypted (TLS) syslog is available on MX Security Appliances running MX26.1 firmware or higher. If an MX Security Appliance is configured for encrypted syslog and downgraded below MX26.1, it will not send syslog whatsoever and would need to be re-configured for syslog without encryption.

The Z-series Teleworker Gateways do not support encrypted syslog. Switches and wireless access points will support Encrypted (TLS) syslog in their future releases.

Due to a now resolved issue, encrypted syslog deployed in a Configuration Template prior to March 6, 2026 will not work properly and will not send encrypted or unencrypted syslog. To resolve this, delete and then readd the encrypted syslog server entry in the Configuration Template.