> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-migration/migrate-from-cortex-xsoar-6-to-cortex-xsoar-8-saas-using-the-pre-migration-and-migration-wizard/step-3.-run-user-acceptance-tests-uat-using-the-migration-wizard/syslog-configuration.md).

# Syslog Configuration

The schema for Syslog events in Cortex XSOAR 8 does not support some fields from Cortex XSOAR 6. If you have customized your Syslog or a system that reads data from your Syslog, you may need to update your customization to match the new schema.

Review the new schema and update your Syslog consumption rules, if needed.

The following table describes the differences in the Syslog schema and formatting between Cortex XSOAR 6 and Cortex XSOAR 8.

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>Syslog Feature</td><td>Cortex XSOAR 6</td><td>Cortex XSOAR 8</td></tr><tr><td>Supported format</td><td><p>Default</p><p>RFC 3164 (Obsolete)</p><p>RFC 5424</p></td><td>RFC 5424</td></tr><tr><td>Supported protocols</td><td><p>UDP</p><p>TCP</p><p>TLS</p><p>Unix</p></td><td><p>UDP</p><p>TCP</p><p>TLS</p><p>Unix protocol is not supported.</p></td></tr><tr><td>Structure</td><td><p>Timestamp HOSTNAME TAG</p><pre><code>CEF:&#x3C;CEFVersion>|&#x3C;CEFVendor>|&#x3C;CEFProduct>|&#x3C;server version>|
&#x3C;audit category>|&#x3C;action>|3|startTime=&#x3C;audit log time> 
cs1=&#x3C;id of the item being audited> cs1Label=identifier 
cs2=&#x3C;action info> cs2Label=details
</code></pre></td><td><p>Syslog Header</p><pre><code>&#x3C;9>: PRI (priority field)
1: version number 
2020-03-22T07:55:07.964311Z: timestamp of when the log was sent 
cortexxsoar: host name
</code></pre><p>CEG Header</p><pre><code>HEADER/Vendor=" Palo Alto Networks" (as a constant string)
HEADER/Device Product="Cortex XSOAR" (as a constant string) 
HEADER/Device Version= Cortex XSOAR 
versionHEADER/Severity=(integer/0 - Unknown, 6 - Low, 8 - Medium, 9 - High)
HEADER/Device Event Class ID=" Management Audit Logs" (as a constant string)
HEADER/name = type
</code></pre><p>CEF Body</p><pre><code>suser=user end=timestamp externalId=external_id 
cs1Label=email (constant string) cs1=user_mail 
cs2Label=subtype (constant string) cs2=subtype 
cs3Label=result (constant string) cs3=result 
cs4Label=reason (constant string) cs4=reason 
msg=event_description tenantname=tenant_name 
tenantCDLid=tenant_id CSPaccountname=csp_id
</code></pre><p>The TAG field is not supported.</p><p>Priority is calculated based on facility (which is by default user action) and event severity, and cannot be overridden.</p></td></tr><tr><td>Login message</td><td><p>Cortex XSOAR 6 login message example</p><pre><code>Jun  7 08:41:43 ip-10-0-61-117 
demisto[250180]: CEF:0|Palo Alto Networks
|Palo Alto Networks Cortex XSOAR
|6.12.0.332840.358f3bc6194648e011d2b0a9da90b682ed15ee52
|login|in|3|suser=admin startTime=1686127303568858 
cs1=admin cs1Label=identifier 
cs2=X-Forwarded-For: 199.203.162.213\nhost/ip: 10.0.78.23:49680\n
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) 
AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/113.0.0.0 Safari/537.36 cs2Label=details
</code></pre></td><td><p>Cortex XSOAR 8 login message example</p><pre><code>&#x3C;14>1 2023-06-15T14:43:42.049391Z cortexxsoar - - - - CEF:0
|Palo Alto Networks|Cortex XSOAR|Cortex XSOAR 8.3.0
|Management Audit Logs|AUTH|0|suser=John Smith end=1686840220823 
externalId=238 cs1Label=email cs1=jsmith@example.com 
cs2Label=subtype cs2=Login cs3Label=result cs3=SUCCESS 
cs4Label=reason cs4=None msg=None tenantname=XSOAR Migration 1 
tenantCDLid=9997230752790 CSPaccountname=211459
</code></pre></td></tr><tr><td>Playbook edit</td><td><p>Cortex XSOAR 6 playbook edit example</p><pre><code>Jun  7 08:48:43 ip-10-0-61-117 demisto[250180]: 
CEF:0|Palo Alto Networks|Palo Alto Networks Cortex XSOAR
|6.12.0.332840.358f3bc6194648e011d2b0a9da90b682ed15ee52
|playbook|edit|3|suser=admin startTime=1686127723985115 
cs1=9026be69-587f-4d15-8bc3-79f9e7e29dba 
cs1Label=identifier cs2=playbookName: test cs2Label=details
</code></pre></td><td><p>Cortex XSOAR 8 playbook edit example</p><pre><code>&#x3C;14>1 2023-06-27T14:44:31.830917Z cortexxsoar - - - - CEF:0
|Palo Alto Networks|Cortex XSOAR|Cortex XSOAR 8.3.0
|Management Audit Logs|XSOAR|0|suser=jSmith 
end=1687877065870 externalId=728 cs1Label=email 
cs1=jsmith@example.com cs2Label=subtype 
cs2=Edit - Playbook cs3Label=result cs3=SUCCESS 
cs4Label=reason cs4=None msg=playbookName: test, 
ID: 9026be69-587f-4d15-8bc3-79f9e7e29dba 
tenantname=XSOAR Migration 3 tenantCDLid=9996914629072 
CSPaccountname=211459
</code></pre></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-migration/migrate-from-cortex-xsoar-6-to-cortex-xsoar-8-saas-using-the-pre-migration-and-migration-wizard/step-3.-run-user-acceptance-tests-uat-using-the-migration-wizard/syslog-configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.