Device syslog is the earliest-warning telemetry you own — fan failures, flapping neighbors, config commits, and auth events all show up here first. Ntrospect ingests syslog at the gateway and correlates it with metrics and flows on the same timeline.

Enable the listener

On the gateway's Configuration tab, the Syslog section exposes:

  • UDP Port — default 54526. If your devices can only send to the traditional port 514, either change this value or redirect 514 → 54526 at the gateway host; sending to a high port avoids running the collector privileged.
  • Protocol — rfc3164 (classic BSD syslog, the default, and what most network gear speaks) or rfc5424 (structured syslog).
  • Timezone — applied to messages whose timestamps carry no zone information (an rfc3164 quirk); set this to the devices' local zone so events line up correctly against metrics.

As with all gateway protocol settings, save at the Global, Cluster, or Gateway scope, preview the generated YAML, and apply.

Point devices at it

Configure each switch, router, firewall, and AP to send syslog to the gateway (or cluster VIP) at the configured port. Send at severity informational and filter at query time — storage is columnar and cheap, and the "noisy" messages are exactly the ones you'll want during an incident.

Using the data

Logs appear under Infrastructure → Logs with severity filtering, message-pattern grouping, and a volume histogram. Two features worth knowing:

  • Log-based alert rules — under Alert Rules, a rule with signal type log fires on a search pattern (e.g. error|exception|fatal) crossing a rate threshold.
  • Evaluations pull matching device logs into incident case files automatically — the fan-error message that explains the interface anomaly surfaces without anyone grepping for it.

Retention

Plain log rows default to 30 days (flow rows share the same table at 14 days). Adjust under Settings → General → Retention Policies.