---
title: "Setting Up the Edge Filer Syslog Service"
slug: "setting-up-the-edge-filer-syslog-service-3-1"
tags: ["Portal", "8.3"]
updated: 2026-08-13T12:39:47Z
published: 2026-08-13T12:39:47Z
canonical: "kb.ctera.com/setting-up-the-edge-filer-syslog-service-3-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up the Edge Filer Syslog Service

**To set up the Edge Filer Syslog service:**

1. In the global administration view, select **Services > Edge Filer Syslog** in the navigation pane. The **Edge Filer Syslog** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-MAXPIJRB.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D)
2. Click **Add a Server** to define the Syslog Server: The **New Syslog Server** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-8ZU8AXIO.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D) **Address** – The address of the Syslog server. **Port** – The syslog server's port number. The default port used by a syslog server is 514 when **Protocol Type** is `UDP`and 6514 when **Protocol Type** is `TCP/TLS` **Protocol** – The protocol to use for sending logs to the syslog server: `UDP` or `TCP/TLS` If `TCP/TLS` is chosen the **New Syslog Server** window changes: ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-OJ2OR8M6.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D)

If there is a problem with the TCP connection or with the TLS certificate, for example the client and server certificates do not match or a certificate has expired, an error is displayed, with additional information written to the [system log](/v1/docs/viewing-logs-12-1#the-system-log).

**Alert if lag exceeds** – The number of messages that are not sent to the Syslog server before an alert is issued,
  1. Click **Client Certificate** to upload the client certificate.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-IWMRQ6KW.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D)
  2. Click **Select File** to select the .pem file client certificate to use.
**Note**

Only pem files are allowed.
  3. Click **Select File** to select the private key. The private key must match the certificate.
  4. Click **Server Certificate** to upload the server certificate.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-Y6IH1I2H.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D)
  5. Click **Select File** to select the .pem file server certificate to use.
**Note**

Only pem files are allowed. The certificate must match the client certificate.
  6. Click **Save**.
3. Click **Save**. The server is added to the list of servers. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-F2EYIW81.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D) The **Status** field is `Unknown` if the UDP protocol is used and either `Connected` or `Not Connected` if the TCP protocol is used.

**Note**

To delete a server, select the server row and click **Delete** and in the confirmation window click **Delete**.
4. Click **Enable** in the status bar. The **Edge Filer Syslog** service starts. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-RW4RLAGJ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D) When the service has finished starting the status changes to **Active** and **Running OK**. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-ZAKOL9MK.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A29%3A02Z&se=2026-11-11T05%3A29%3A02Z&sr=c&sp=r&sig=kN7NRg0M1b0MHLWQEsXoXcii26sBTZzcBqnOe9vnfds%3D)
5. Enable CIFS/SMB Audit Logs on every CTERA Edge Filer you want to use with the **Edge Filer Syslog** service and enable log forwarding to the portal on these edge filers. Log forwarding is enabled from edge filer version 7.11.x in the user interface, in the [Logs > Log Forwarding](/v1/docs/forwarding-logs-to-the-portal) page and in earlier versions using CLI.