Enable or Check Syslog/CEF on SonicWall

Log in to SonicWall UI 

 

 Open a web browser 

 Go to your SonicWall’s IP (e.g., https://192.168.1.1 ) 

 Login with your admin credentials 

 

 

 Navigate to Log Settings 

 

 Go to:

 

 Log > Syslog 

 (On older firmware: Log > Syslog > Syslog Servers ) 

 

 

 You’ll see the list of configured Syslog Servers 

 

 

 Check Syslog Server Configuration 

 

 Make sure the following are set:

 

 Syslog Server IP Address : should be the IP of the Elastic Agent host 

 Port : default is 514 for UDP, or 6514 for TCP/TLS 

 Syslog Format :

 

 Can be set to Default , Syslog , or CEF (Common Event Format) 

 For Elastic integrations, Syslog or CEF is typically supported 

 

 

 

 

 

 

 Enable Log Categories 

 

 Still under Log > Syslog , click Syslog Settings 

 Ensure that Important log categories are enabled for syslog , like:

 

 Firewall 

 VPN 

 System 

 User Activity 

 Connection dropped 

 

 

 Set Alert level or Priority : e.g., Information or Notice 

 

 

 If Using CEF Format (For Elastic Agent CEF Integration) 

 

 Some SonicWall models support  CEF log format :

 

 Go to Log > Syslog 

 Look for an option like “Syslog Format” or “Use CEF” 

 Enable CEF output 

 

 

 Note: Not all SonicWall devices support native CEF. 

 

 

 Advanced Settings (Optional) 

 

 Under Log > Syslog Settings , check:

 

 Syslog Facility (can be left as default: Local0 or Local4 ) 

 Use Syslog over TLS if required, and provide the correct certs 

 

 

 

 

 Save and Apply 

 

 Click Apply or Accept to confirm changes 

 Ensure the firewall can reach the Elastic Agent on the configured port