USM Anywhere Log Collection

Overview
USM Anywhere Architecture
USM Anywhere Data Security
USM Anywhere Log Data Enhancement
USM Anywhere Quick Start Guides
USM Anywhere Deployment Guide
USM Anywhere User Guides
- Overview
- Getting Started with USM Anywhere
- USM Anywhere Best Practices
- USM Anywhere Dashboards
- Asset Management
- Alarms Management
- System Events Management
- Console User Events on USM Anywhere
- Configuration Issues Management
- User Behaviour Analytics
- Events Management
- USM Anywhere Scheduler
- Rules Management
- Vulnerability Assessment
- Open Threat Exchange® and USM Anywhere
- USM Anywhere Sensor Management
- The AWS Cloud Connector in USM Anywhere
- Subscription Management
- USM Anywhere Reports
- Machine Learning
- USM Anywhere User Management
- Using USM Anywhere for PCI Compliance
- USM Anywhere Investigations
- System Status within USM Anywhere
  - Overview
  - USM Anywhere Network System
  - USM Anywhere System Monitor
  - USM Anywhere Log Collection
USM Anywhere Agents Guide
USM Anywhere BlueApps Guide


Role Availability	Read-Only	Investigator	Analyst	Manager

Syslog is a message-logging standard supported by most devices and operating systems (OSes). USM Anywhere can collect syslog data from devices in your environment and produce corresponding security events and alarms. You can forward syslog data from specific device types to the USM Anywhere Sensor IP address and port.

Note: See The Syslog Server Sensor App, Data Sources and Log Processing, and Enable Connections in an AWS VPC for more information.

To open the Log Collection page

Go to Settings > System.
In the left navigation panel, click Log Collection > Syslog Configuration.
If you have more than one USM Anywhere Sensor deployed, use the drop-down menu to select the sensor that you want to configure log collection.

Note: If the sensor is receiving syslog messages from your network, you will see IP addresses listed under Device Sending Data. For performance reasons, this list only includes devices sending logs in the last 15 minutes. The list refreshes every 30 seconds. After the sensor is updated or the syslog-ng server used by the sensor restarts, the list is reset.
Click How do I configure my device? to see the instructions for your operating system:
- Windows: This is a link to the Collecting Windows System Logs page.
- Linux: This is a link to the Collecting Linux System Logs page.

USM Anywhere System Monitor Overview

USM Anywhere™

USM Central™

Automated Policy Manager

USM Anywhere Log Collection