Vendor & protocol setup · 5 min read

Send syslog to Linivo over TLS

Forward device logs to Linivo with TLS encryption instead of plaintext UDP, so log contents aren't exposed on the wire.

What you'll need

  • A device or log shipper that supports RFC 5425 (syslog over TLS)
  • A Linivo sensor with the syslog-TLS listener enabled
1

Enable the TLS listener

Turn on the syslog-TLS listener under Settings > Sensors > (this sensor) > Log ingestion; it listens on TCP/6514 by default and generates a certificate for you, or accepts your own.

2

Point the device at it

Configure the sending device or log shipper (rsyslog, syslog-ng, or the device's native syslog client) to use TCP with TLS, targeting the sensor's IP on port 6514.

# rsyslog.conf
action(type="omfwd" target="10.20.0.50" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name")
3

Verify delivery

Check Devices > (this device) > Logs for incoming entries. A TLS handshake failure here is almost always a certificate trust issue between the sender and the sensor.