Syslog Policy

A Syslog Policy configures local and remote syslog logging on UCS servers and IMC endpoints, controlling the minimum severity level for local file logging and forwarding log messages to up to two remote syslog servers.

Location in Intersight GUI: Policies » Syslog

Diagram

Classes

policies (compute.intersight.organizations)

Name	Type	Constraint	Mandatory	Default Value
syslog	List	[syslog]	No

syslog (compute.intersight.organizations.policies)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
description	String		No
managed	Boolean	true, false	No	true
tags	List	[tags]	No
local_min_severity	Choice	warning, emergency, alert, critical, error, notice, informational, debug	No	warning
remote_clients	List	[remote_clients]	No

tags (compute.intersight.organizations.policies.syslog)

Name	Type	Constraint	Mandatory	Default Value
key	String		Yes
value	String		Yes

remote_clients (compute.intersight.organizations.policies.syslog)

Name	Type	Constraint	Mandatory	Default Value
hostname	String		Yes
enabled	Boolean	true, false	No
port	Integer	min: 1, max: 65535	No
protocol	Choice	udp, tcp	No
min_severity	Choice	warning, emergency, alert, critical, error, notice, informational, debug	No

Examples

Example-1: Configure a syslog policy with local warning-level logging only.

compute:
  intersight:
    organizations:
      - name: MyOrg
        policies:
          syslog:
            - name: MySyslogPolicy
              local_min_severity: warning
              tags:
                - key: env
                  value: prod

Example-2: Configure a syslog policy that forwards critical events to a remote syslog server.

compute:
  intersight:
    organizations:
      - name: MyOrg
        policies:
          syslog:
            - name: MySyslogPolicy
              local_min_severity: warning
              remote_clients:
                - hostname: 10.0.0.200
                  port: 514
                  protocol: udp
                  min_severity: critical

Example-3: Configure a syslog policy with two remote syslog destinations at different severity thresholds.

compute:
  intersight:
    organizations:
      - name: MyOrg
        policies:
          syslog:
            - name: MySyslogPolicy
              local_min_severity: informational
              remote_clients:
                - hostname: syslog-primary.example.com
                  port: 514
                  protocol: udp
                  min_severity: warning
                - hostname: syslog-secondary.example.com
                  port: 6514
                  protocol: tcp
                  min_severity: error
                  enabled: false