> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md). # Activate Syslog Collector {% hint style="info" %} ### Notice Ingesting logs and data from external sources requires a Cortex XDR Pro per GB license. {% endhint %} {% hint style="info" %} ### Note Collecting data from Corelight Zeek, Forcepoint DLP, and PingFederate by activating the Syslog Collector applet is only possible in your tenant if the tenant was activated before October 1, 2025 with an active Data Collection add-on. {% endhint %} To receive Syslog data from an external source, you must first set up the Syslog Collector applet on a Broker VM within your network. ### Specifications and limits To ensure reliable data ingestion, observe the following technical specifications and protocol-specific constraints: * Ingestion rate​​: The Syslog Collector supports a log ingestion rate of up to 90,000 logs per second (lps) with the recommended Broker VM setup. * Port capacity​​: The Syslog Collector listens for logs on specific ports and from any or specific IP addresses. A single Syslog Collector configuration supports up to 100 ports. * Protocol support​​: The collector supports TCP, Secure TCP, and UDP, following the RFC 6587 standard for transmission over TCP. ### Message size limitations * UDP​​: Each syslog message is limited to 4 KB (the size of the read buffer). Messages exceeding this size will be truncated. * TCP with Non-Transparent-Framing​​: This is the most common option, using the newline character `​\n​​` (`Hex 0x0A`) as the end-of-line delimiter for syslog messages. In this mode, each message is limited to 64 KB. Messages larger than 64 KB are dropped and will cause the connection to close. * TCP with Octet Framing​​: This method relies on the length specified by the sender. There is no explicit message size limit; the only practical limitation is the available system memory. This is the recommended framing for messages exceeding 64 KB. {% hint style="warning" %} ### Prerequisite [Set up and configure Broker VM](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm.md) {% endhint %} Perform the following procedures in the order listed below.
Task 1. Add a Syslog Collector 1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**. 2. Do one of the following: * On the **Brokers** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **Syslog Collector**. * On the **Clusters** tab, find the Broker VM, and in the **APPS** column, left-click **Add** → **Syslog Collector**.
Task 2. Configure the Syslog Collector Cortex XDR supports multiple sources over a single port on a single Syslog Collector. The following options are available: * Edit the **Optional Settings** of the default **PORT/PROTOCOL**: **514/UDP**. See **Task 3**.

Note

Once configured, you cannot change the Port/PROTOCOL. If you don’t want to use a data source, ensure to remove the data source from the list as explained in Task 5.

* Add a new Syslog Collector data source. See **Task 4**.
Task 3. Edit the default 514/UDP Syslog Collector data source 1. Right-click the **514/UDP** PORT/PROTOCOL, and select **Edit**. 2. Configure these **Optional Settings**: | Field | Description | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Format |

Select the Syslog format you want to send to the UDP 514 protocol and port on the Syslog Collector: Auto-Detect (default), CEF, LEEF, CISCO, or RAW.

Note

| | Vendor and Product | Specify a particular vendor and product for the Syslog format defined or leave the default **Auto-Detect** setting. | | Source Network | Specify the IP address or Classless Inter-Domain Routing (CIDR). If you leave this blank, Cortex XDR will allow receipt of logs from any source IP address or CIDR that transmits over the specified protocol and port. When you specify overlapping addresses in the **Source Network** field in multiple rows, such as 10.0.0.10 in the first row and 10.0.0.0/24 in the second row, the order of the addresses matter. In this example, the IP address 10.0.0.10 is only captured from the first row definition. For more information on prioritizing the order of the syslog formats, see **Task 5**. | After each configuration, select ![blue-arrow.png](/files/t2ipS9RoF3rs1stLzkrY) to save the changes and then **Done** to update the Syslog Collector with your settings.
Task 4. Add a new Syslog Collector data source 1. Select **Add New**. 2. Configure these mandatory **General settings**: **Protocol** Choose a protocol over which the Syslog will be sent: **UDP**, **TCP**, or **Secure TCP**. When configuring the **Protocol** as **Secure TCP**, these additional **General Settings** are available: * **Server Certificate**: Browse to your server certificate to configure server authentication. * **Private Key**: Browse to your private key for the server certificate. * **Optional CA Certificate**: (Optional) Browse to your CA certificate for mutual authentication. The log forwarder (for example, a firewall) authenticates the Broker VM by default. The Broker VM does not authenticate the log forwarder by default, but you can use this option to set set up such authentication. If you use this option, ensure that you have a client certificate on the log forwarding side that matches the CA certificate on the Broker VM side. * **Minimal TLS Version**: Select either **1.0** or **1.2** (default) as the minimum TLS version allowed. {% hint style="info" %} #### Note * The server certificate and private key pair is expected in a PEM format. * Cortex XDR will notify you when your certificates are about to expire. {% endhint %} **Port** Choose a port on which the Syslog Collector will listen for logs. A Syslog Collector configuration supports up to 100 ports. {% hint style="info" %} #### Note Because some port numbers are reserved by Cortex XDR , you must choose a port number that is not: * In the range of 0-1024 (except for 514) * In the range of 63000-65000 * Values of 4052, 4369, 5671, 5672, 5986, 6379, 8000, 8888, 9100, 15672, or 28672 {% endhint %} 3\. Configure these **Optional Settings**: | Field | Description | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Format |

Select the Syslog format you want to send to the protocol and port on the Syslog Collector: Auto-Detect (default), CEF, LEEF, CISCO, CORELIGHT, or RAW.

Note

CORELIGHT is not available for a UDP protocol.

| | Vendor and Product | Enter a particular vendor and product for the Syslog format defined or leave the default **Auto-Detect** setting. | | Source Network | Specify the IP address or Classless Inter-Domain Routing (CIDR). If you leave this blank, Cortex XDR will allow receipt of logs from any source IP address or CIDR that transmits over the specified protocol and port. When you specify overlapping addresses in the **Source Network** field in multiple rows, such as 10.0.0.10 in the first row and 10.0.0.0/24 in the second row, the order of the addresses matter. In this example, the IP address 10.0.0.10 is only captured from the first row definition. For more information on prioritizing the order of the syslog formats, see **Task 5**. | After each configuration, select to save the changes and then **Done** to update the Syslog Collector with your settings.
Task 5. Make additional changes to the Syslog Collector data sources configured * To remove a Syslog Collector data source, right-click the row after the **Port/Protocol** entry, and select **Remove**. * To prioritize the order of the Syslog formats listed for the protocols and ports configured, drag and drop the rows to the order you require.
Task 6. Save the Syslog Collector settings Click **Save**. After a successful activation, the **APPS** field displays **Syslog** with a green dot indicating a successful connection.
Task 7. (optional) View metrics about the Syslog Collector To view metrics about the Syslog Collector, left-click the **Syslog** connection in the **APPS** field for your Broker VM. Cortex XDR displays the following information: | Metric | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connectivity Status | Whether the applet is connected to Cortex XDR. | | Logs Received and Logs Sent | Number of logs received and sent by the applet per second over the last 24 hours. If the number of incoming logs received is larger than the number of logs sent, it could indicate a connectivity issue. | | Resources | Displays the amount of **CPU**, **Memory**, and **Disk** space the applet is using. |
Step 8. Manage the Syslog Collector After the Syslog Collector has been activated, you can make additional changes to your configuration if needed. To modify a configuration, left-click the **Syslog** connection in the **APPS** column to display the Syslog Collector settings, and select: * **Configure** to redefine the Syslog configurations. * **Deactivate** to disable the Syslog Collector.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.