Connect Customer Monitoring and Syslog

Configure the optional customer metrics interface and customer log export in Management. Local collection and dashboards continue independently of these settings.

Use a Management administrator account with active appliance access. Check the client network path and prepare the receiver address, credentials and certificates. Changes may temporarily interrupt external access while the appliance applies them.

Enable Customer Metrics

  1. Open Settings > Metrics.

  2. Choose an Access mode:

    Mode Behavior

    Disabled

    The shipped setting. Port 9443 is closed.

    Anonymous

    Anyone who can reach port 9443 can scrape product metrics.

    Basic authentication

    Supply one username and password hash as an htpasswd entry. The appliance does not generate the client’s credential.

    Mutual TLS

    Supply the PEM CA bundle trusted to sign monitoring client certificates.

  3. For Basic authentication, generate an entry using htpasswd -nB <user> and paste it into htpasswd entry. For mutual TLS, paste the trusted certificates into Client CA bundle. Multiple CAs can coexist during rollover.

  4. Select Save and apply, review the access change and select Commit changes.

  5. Configure the monitoring client to scrape <appliance-installation-hostname>:9443/metrics every 30 seconds. Use the appliance installation endpoint and verify its gateway certificate, with the authentication required by your selected mode.

  6. Verify successful scrapes and current product metrics on the monitoring client.

This interface exposes a selected set of product metrics. It does not grant unrestricted access to internal monitoring data. Disabling it closes the external port while local monitoring continues.

When replacing an existing access policy, first select Disabled, apply it, and verify from the client network that port 9443 is closed. Then configure and enable the replacement policy. Test both an accepted credential and a credential that should be rejected. A failed gateway reload can retain the previous access policy, so submitting a new mode or CA bundle alone does not prove that old access ended. The mutual-TLS interface does not process CRLs or OCSP responses.

Forward Logs to Syslog

  1. Open Settings > Log forwarding and select Forward logs to a syslog destination.

  2. Enter the receiver Host and Port. The configuration permits that destination and port through the appliance’s egress policy.

  3. Choose TCP for TCP or TLS transport. Choose RFC 5424 unless your receiver requires the RFC 3164 compatibility format. UDP is also a compatibility option.

  4. Set Maximum message size to the receiver’s accepted limit. The defaults are 2048 bytes for RFC 5424 and 1024 bytes for RFC 3164.

  5. For encrypted delivery, select Encrypt with TLS and supply the Destination CA bundle. Supply a matching client certificate and key only if the receiver requires mutual TLS. Certificate and hostname verification remain enabled with no plaintext fallback.

  6. Select Save and apply, review the destination and credential changes, and select Commit changes.

  7. Verify that new records arrive at the actual receiver. In Grafana, inspect Customer Log Export for queue growth, retries, dropped records and truncation.

For server-authenticated TLS, the destination CA bundle is sufficient. When editing an existing mutual-TLS configuration, blank client certificate and key fields preserve the saved pair; leaving them blank does not remove client authentication.

Choose a TCP/TLS receiver that accepts LF-delimited framing. A successful TCP or TLS transfer does not confirm that the receiver stored the records. Check that you can retrieve them there.

Plan for Export Boundaries

Log forwarding sends operational records and CLM/CARA audit records to the same configured destination. Audit records bypass ordinary redaction, so the receiver must be authorized to handle them. Syslog escaping and message-size limits can change or truncate the exported copy. A truncated Syslog audit record cannot be used to verify the original signature; local history retains the original payload independently.

Queues have size limits, and records can be dropped or duplicated. Enabling forwarding does not backfill local history. Changing the destination redirects surviving queued copies as well as new records. Disabling forwarding stops external delivery after reconciliation while local collection continues; do not assume pending copies will survive a disable and re-enable cycle.

If delivery fails, check DNS, routing, receiver capacity, trust and credentials. Correct the configuration and verify that new records arrive and queues drain. Record any interval that cannot be recovered. See local history and ports and protocols.

If the page reports The settings changed in Git, select Reload settings, review the new committed values and reapply your intended edits. Reloading discards unsaved edits.