• SonicOS 8
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About Device
  • Device Log Introduction
• Settings
  • Filtering the Base Setup View
  • Configuring the Logging and Alert Levels
    • Setting the Logging Level
    • Setting the Alert Level
  • About Other Top Row Buttons
    • Edit Attributes of All Categories
    • Reset All Event Counts
    • Save Template
    • Import Template
      • Default Template
      • Minimal Template
      • Analyzer/ViewPoint/GMS Template
      • Firewall Action Template
      • Custom Template
    • View Logs
  • About the Log Settings Base Setup Table
    • Category Column
    • Color Column
    • ID Column
    • Priority Column
    • GUI Column
    • Alert Column
    • Syslog Column
    • Internet Protocol Flow Information Export (IPFIX) Column
    • Email Column
    • Event Count Column
    • Edit and Reset Count Icons
  • Configuring Event Attributes Globally
  • Configuring Event Attributes Selectively
    • Configuring Event Attributes by Category
    • Configuring Event Attributes by Group
    • Configuring Event Attributes by Event
    • About Filename Logging
• Syslog
  • About Event Profiles
  • About Syslog Server Profiling
  • Using a GMS/Analytics Server for Syslog
  • Syslog Settings
  • Syslog Servers
    • Adding a Syslog Server
    • Editing a Syslog Server
    • Enabling Syslog Servers
    • Disabling Syslog Server
    • Deleting Syslog Servers
• Automation
  • Email Settings
  • Mail Server Settings
  • FTP Log Automation
• Name Resolution
• Reports
  • Data Collection
  • View Data
  • Backup Logs Information
• AWS
  • Enabling AWS Logs
• SonicWall Support
  • About This Document

About Syslog Server Profiling

This feature provides the ability to configure the settings for each Syslog server independently, instead of using the global settings for all the servers. In previous releases, the events generated from all the modules in the system were reported to all the configured Syslog servers. Depending on the deployment, this generates a huge amount of Syslog traffic and can cause performance issues or even packet loss.

With Syslog Server Profiling, the following new functionality is available:

Recommended maximum of 10 Syslog Servers users would use the dedicated syslog profiles allocated (exception for model NSsp 15700 Series).

• Syslog messages can be sent using different settings for different Syslog servers
• There can be multiple groups of Syslog servers
• Different events can be configured to be reported to different groups of Syslog servers

All the settings in the Log > Syslog page except Enable NDPP Enforcement for Syslog Server can be configured independently for each row in the Syslog Servers table. This allows Syslog messages to be rendered with different settings for different servers, and each server can have its own Rate Limiting options.

Enable/Disable sending of Syslog messages to a specific Syslog server. The settings for Enhanced Syslog and ArcSight format can also be configured individually.

All these settings can be configured from the SonicOS web interface and from the command line interface (CLI.) For convenience, the global settings can be used to configure all servers.

The Override Syslog Settings with Reporting Software Settings option has been removed. As the Syslog servers have their own independent settings, this option is no longer needed.