# Integrate with Syslog Server

**Last Updated On**: 24 Jul 2026  
**5 minutes read**

Endpoint Central supports forwarding audit logs (**Admin → Audit → Action Log Viewer**) to external Syslog servers using the standardized RFC 5424 format, enabling organizations to centralize audit data in platforms like SIEM tools for enhanced visibility, real-time threat detection, and compliance readiness.

> **Note:** This feature is available in Endpoint Central version 11.4.2524.01 or later.

## Key Benefits of Integration

- **Centralized Audit Log Management:** Consolidate Endpoint Central audit logs with logs from other systems into a centralized repository, simplifying log analysis, long-term retention, and reporting.
- **Enhanced Security Monitoring:** Streamline near real-time security monitoring by forwarding logs to SIEM tools that support alerting, correlation, and visualization of critical events.
- **Compliance and Audit Support:** Maintain a consistent, tamper-evident record of console activities to support internal audits and meet regulatory compliance standards.

## Steps to Integrate Endpoint Central with Syslog Server

1. In the Endpoint Central web console, navigate to **Admin → Integrations → All Integrations**.

   ![Endpoint Central Admin panel showing All Integrations under Integrations](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/syslog-steps.webp)

   *All Integrations page under Admin → Integrations in Endpoint Central.*

2. Search for **Syslog** and click **Configure**.

   ![All Integrations search results showing Syslog with the Configure button](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/syslog-1.webp)

   *Syslog in the All Integrations search results with the Configure option.*

3. Enter the Syslog server details:

   - **Syslog Server Address:** Enter the IP address or hostname of your Syslog server.
   - **Protocol:** Choose between `TCP` or `UDP`.
   - **TLS Enabled:** Enable this only if your Syslog server supports and is configured for TLS to ensure secure communication.
   - **Server Port:** Specify the listening port of the Syslog server.

   > **Note:** If FIPS Compliance is enabled, only the TLS protocol is permitted for Syslog integration to ensure encrypted communication.

4. Optionally, enable notifications for integration failure:

   - **Email Address:** Add email recipients to receive notifications.
   - **Mobile App:** Select technicians to be notified via the mobile app.

5. Click **Save** to complete the integration.

   ![Syslog server configuration panel showing server address, protocol, TLS, port, and notification settings with the Save button](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/syslog-2.webp)

   *Syslog server configuration panel showing all required fields and the Save button.*

6. If your Syslog server is using an SSL certificate that Endpoint Central does not recognize, you must verify and trust the certificate.

   ![Trust certificate dialog for Syslog server SSL certificate verification in Endpoint Central](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/syslog-trust.webp)

   *Trust certificate dialog for verifying the Syslog server SSL certificate.*

7. Confirm your consent by clicking **Yes, Proceed** to allow Endpoint Central to share **Action Log Viewer data** with your Syslog server.

   ![Consent confirmation dialog showing the Yes Proceed button to allow Action Log Viewer data sharing with the Syslog server](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/syslog-confirm.webp)

   *Consent confirmation dialog for sharing Action Log Viewer data with the Syslog server.*

8. Endpoint Central is now integrated with your Syslog server successfully.

   ![Syslog integration details view showing the active integration status between Endpoint Central and the Syslog server](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/integrations/ec-syslog-details-view.webp)

   *Syslog integration details view showing the active integration status.*

## Related

- [Integrate with Splunk SIEM using Syslog (Video)](https://youtu.be/Zv7e67aF1y8)
- [Integrate with Elasticsearch SIEM using Syslog (Video)](https://youtu.be/Zv7e67aF1y8)
- [Integrate with Splunk Enterprise](https://www.manageengine.com/products/desktop-central/help/integration/integrate-with-splunk.html)
- [Integrate with Log360 - EventLog Analyzer](https://www.manageengine.com/products/desktop-central/help/integration/integrate-with-log360-eventlog-analyzer.html)
- [All Integrations](https://www.manageengine.com/products/desktop-central/integration.html)
- [Vulnerability Management Overview](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/vulnerability-management-overview.html)