Prerequisites
To forward syslogs from Ubiquiti UniFi to LogCentral and benefit from our cloud based log storage, you'll need:
An active LogCentral location which will provide you with the IP & port to which you need to forward your syslogs. Don't forget to configure your own IP address(es) in your location.
Access to the settings of your UniFi network
Connect your UniFi admin console, for example through UniFi's cloud portal at https://unifi.ui.com/
Getting your location's dedicated IP / port
First, in your LogCentral location, you'll find a "Configuration" section.
Here is how this information is presented in LogCentral's location details:
Note down the IP and the port. In this example 49.12.218.35 is the server address and 15866 is the port.
You'll need these two informations in a minute.
The syslog settings can be located in two places depending on your UniFi equipment. The two possibilities are listed below.
Option 1) Syslog settings in the CyberSecure menu
This is the most common place to find the setting for recent & up to date UniFi setups.
Click on the picture to see it in a bigger size
Steps:
Click the Gears icon on the bottom left
Then on CyberSecure
then on Trafic Logging
Select SIEM Server
Select the type of logs you want to forward to LogCentral. You can select all event types if needed.
In the server address, fill in the IP address available in your previously created LogCentral location
In the port field, enter the port you have been assigned in LogCentral
Click Apply Changes
Option 2) Syslog settings in the System / Integrations menu
Click on the picture to see it in a bigger size
Steps:
Click the Gears icon on the bottom left (
then on System
then on Integrations
finally on SIEM Server
Select the type of logs you want to forward to LogCentral. You can select all event types if needed.
In the server address, fill in the IP address available in your previously created LogCentral location for example in this screenshot, 49.12.218.35 is the server address
In the port field, enter the port you have been assigned in LogCentral
Click Apply Changes
Once finished, click "Apply changes" in UniFi's dashboard.
If everything is well in a few seconds or minutes you should see logs appearing in LogCentral.
Congrats!