Free cookie consent management tool by TermsFeed

Log Streaming to Syslog Receiver

Requires Appian Protect Professional Success Plan or higher
On This Page

This page applies to Appian Cloud only. It may not reflect the differences with Appian Government Cloud.

This page describes how to stream supported Appian Cloud logs, in real time, to a syslog receiver that your organization hosts. The content applies to Appian Cloud administrators who want to centralize logs in their existing Log Management and Security Information and Event Management (SIEM) tools.

Tip:  Alternate supported streaming destinations include a self-hosted Amazon S3 bucket or OpenTelemetry Protocol (OTLP) endpoint.

How log streaming to a syslog receiver works

Appian Cloud environments can be configured to stream supported logs, in real time, to your own syslog receiver. Once logs are stored in a central repository, you can index, access, search, and correlate events using your existing Log Management and Security Information and Event Management (SIEM) tools.

The log-streaming service operates on a push-based model, in which Appian Cloud environments are configured to send a stream of logs to your syslog receiver. Logs are forwarded in real-time as the messages are written in the Appian Cloud environment.

These logs can be further digested and aggregated by tools of your choice, such as Splunk, LogRhythm, and Elasticsearch-Logstash-Kibana (ELK) stack.

Benefits of log streaming to a syslog receiver

With the log-streaming service enabled on your Appian Cloud environment, you can integrate the information contained in the logs for a consolidated view of your enterprise operations. Some benefits of this service include:

  • Simplified log management: You can easily consume your logs from a centralized location.
  • Faster diagnosis and troubleshooting of your enterprise applications: You benefit from increased visibility of debugging messages. For example, you can expose these messages to Appian designers and system administrators to quickly resolve application-level incidents as soon as they are generated.
  • Improved system visibility: You can assess historic performance by aggregating system metrics over time. This allows you to visualize, identify, and predict patterns in the demand of your enterprise applications.
  • Integrated security analytics: You can continuously monitor sign-in activity to your Appian Cloud environment. By integrating with other enterprise systems, you can audit and correlate patterns in a unified platform.

Supported connection methods

Log streaming supports transmitting messages to either a self-hosted syslog receiver or a Sumo Logic Cloud Syslog Source. For a self-hosted syslog receiver, you can connect over an IPsec VPN tunnel, AWS PrivateLink, or TLS 1.2 over the public internet.

Self-hosted syslog receiver (IPsec VPN tunnel)

The following figure shows the message flow between your Appian Cloud environment and a self-hosted syslog receiver using an IPsec VPN tunnel.

Message flow from an Appian Cloud environment to a self-hosted syslog receiver over an IPsec VPN tunnel

Log transmission is performed over an IPsec VPN tunnel established to your network. As an additional security layer, syslog messages can be encrypted using a TLS certificate installed on the syslog receiver that you provide. TLS encryption is enabled by default but can be disabled upon your request.

The following figure shows the message flow between your Appian Cloud environment and a self-hosted syslog receiver using AWS PrivateLink.

Message flow from an Appian Cloud environment to a self-hosted syslog receiver over an AWS PrivateLink connection

Log transmission is performed using an AWS PrivateLink connection established to your network. Syslog messages are encrypted with TLS using a trusted public CA-signed certificate that you install on your own syslog receiver.

Self-hosted syslog receiver (TLS 1.2)

The following figure shows the message flow between your Appian Cloud environment and a self-hosted syslog receiver over the public internet using TLS 1.2.

Message flow from an Appian Cloud environment to a self-hosted syslog receiver over the public internet using TLS 1.2

Log transmission is performed using TLS 1.2 with TCP and syslog messages are encrypted using a publicly trusted CA-signed certificate that you install on your syslog receiver.

Sumo Logic Cloud Syslog Source

The following figure shows the message flow between your Appian Cloud environment and a Sumo Logic Cloud Syslog Source.

Message flow from an Appian Cloud environment to a Sumo Logic Cloud Syslog Source over the internet

For a Sumo Logic Cloud Syslog Source, log transmission is performed over the internet and syslog messages are encrypted with TLS using the trusted public CA-signed certificate provided by your Sumo Logic deployment.

Supported logs

The following logs can be forwarded to your syslog receiver. Select a tab to view the logs for that category.

Each row describes a single log file:

  • Log: The name of the log file (without extension), linked to its detailed description.
  • Format: The file extension (.csv or .log).

To add or remove logs from streaming, open a support case.

Log Format Tag
admin_console_audit .csv admin-console-audit:
admin_console_user_start_pages_audit .csv admin-console-user-start-pages-a:
ai_guardrail_violations .csv ai-guardrail-violations:
authz-audit .csv authz-audit:
blocked_files .csv blocked-files:
deletion .log deletion:
design_objects .csv design-objects:
event_consumer .csv event-consumer-audit:
event_consumer_errors .csv event-consumer-errors:
event_consumer_events_errors .csv event-consumer-event-errors:
forgot_password_requests .csv forgot-password-requests:
group_management .csv group_management:
login-audit .csv login-audit:
logout-audit .csv logout-audit:
password_resets .csv password-resets:
rdbms-audit .log rdbms-audit:
records_usage .csv records-usage:
saml_failed_logins .csv saml-failed-logins:
secure_credentials_store .csv secure-credentials-store:
sites_usage .csv sites-usage:
task_errors .csv task-errors:
unscanned_files .csv unscanned-files:
user_management .csv user-management:
username_changes .csv username-changes:
Log Format Tag
system .csv system-metrics:
Log Format Tag
ads_call_trace .csv ads-call-trace:
ai_input_output_activity .log ai-input-output-activity:
artificial_intelligence .csv artificial-intelligence:
data_store_details .csv data-store-details:
data_store_summary .csv data-store-summary:
engine_call_summary .csv engine-call-summary:
engine_summary .csv engine-summary:
event_consumer_details .csv event-consumer-details:
event_consumer_summary .csv event-consumer-summary:
expressions_details .csv expressions-details:
integration_details .csv integration-details:
interface_query_record_type_details .csv interface-query-record-details:
perf_monitor_rdbms .csv perf-monitor-rdbms:
perf_monitor_rdbms_slow .csv perf-monitor-rdbms-slow:
query_record_type_details .csv query-record-type-details:
sail_details .csv sail-details:
sail_summary .csv sail-summary:
sail_trace .csv sail-trace:
stored_procedures_slow .csv stored-procedures-slow:
web_api_details .csv web-api-details:
web_api_summary .csv web-api-summary:
work_poller_details .csv work-poller-details:
Log Format Tag
appender-gateway .log appender-gateway:
appianusername-ipaddress-tomcat-access .log appianusername-ipaddress-tomcat:
data-server-client-errors-detail .log data-server-client-error-detail:
deployment .log deployment:
design_errors .csv design-errors:
jidoka .log jidoka:
rts-slow-queries-* .log rts-slow-queries:
tomcat-access .log tomcat-access:
tomcat-stdOut .log tomcat-logs:
tomcat-stdOut .log autoscale-tomcat-logs:

Message format

Syslog messages have the following format:

1

<PRI> <TIMESTAMP> <HOSTNAME> <TAG> <MESSAGE>
  • PRI: Specifies the priority of the syslog message (RFC5424)
  • TIMESTAMP: Date and time of the message. The value is expressed in the timezone configured on your syslog receiver.
  • HOSTNAME: Appian Cloud environment name.
  • TAG: Message tag depending on the log file.
  • MESSAGE: Complete log message generated by the Appian component. Messages also contain timestamps expressed in Greenwich Mean Time Zone (GMT).

Prerequisite checklist

Prerequisite Description Organizational role
Professional or Signature Success Plan order form This offering is available via Professional or Signature Success Plans. Business relationship owner
Update to a current Appian version Appian Cloud environments with this feature enabled must run a supported Appian version per the Support Policy. Authorized Support Contact
Set up an IPsec VPN tunnel, AWS PrivateLink, or TLS 1.2 connection (Only required for self-hosted syslog receivers.) For self-hosted syslog receivers, you must establish an IPsec VPN tunnel, AWS PrivateLink, or TLS 1.2 connection to your network to allow connectivity to your syslog receiver. Both static and dynamic IPsec VPN tunnels are compatible with log streaming. For detailed steps, see Cloud VPN Integration, Dynamic VPN Routing, or Access Customer VPC using AWS PrivateLink. Network administrator / Authorized Support Contact
Set up syslog receiver Sumo Logic Cloud Syslog Source: Configure a Cloud Syslog Source in your account. See the Sumo Logic documentation.
Self-hosted syslog receiver: The receiver must listen for messages over TCP; UDP is not supported. By default, the syslog clients in your Appian Cloud environment connect using TLS, so you must enable TLS and install a valid publicly trusted CA-signed certificate. You can only use a certificate signed by a private CA or a self-signed certificate over an IPsec VPN tunnel. Upon request, Appian can disable TLS encryption only for self-hosted receivers using IPsec VPN tunnels; this is not recommended because logs would travel in clear text after the traffic leaves the VPN device.		 Server / network administrator

Enable log streaming to a syslog receiver

Before you begin, you must complete every item in the Prerequisite checklist section. Once all prerequisites are complete, follow these steps to enable log streaming in your Appian Cloud environment:

  1. Open a support case to request that Appian enable log streaming to a syslog reciever in your Appian Cloud environment. Provide the following details:
    • Syslog receiver target:
      • For self-hosted syslog receivers using IPsec VPN, provide a private IP address or hostname that is part of your private network space.
      • For self-hosted syslog receivers using AWS PrivateLink or TLS 1.2, provide the hostname of your syslog receiver.
      • For Sumo Logic, provide the endpoint hostname.
    • Port.
    • Token (Sumo Logic only). You must provide the token generated during setup. Provide this information to Appian Support over the phone or in person to be consistent with good security practices.

  2. Appian Support schedules a maintenance window and deploys the necessary configurations.

    After the maintenance window completes, your Appian Cloud environment starts forwarding logs to your syslog receiver.

Feedback