Free cookie consent management tool by TermsFeed

Log Streaming to Syslog Receiver

Requires Appian Protect Professional Success Plan or higher
On This Page

This page applies to Appian Cloud only. It may not reflect the differences with Appian Government Cloud.

Note:  Log streaming is available only to customers enrolled in Professional or Signature Success Plans. The functionality described in this page is not included in the base Appian platform.

Overview

Tip:  This page describes how to stream logs to a syslog log receiver at your organization. If your organization uses Amazon S3, you can stream logs directly to your S3 bucket instead. Learn more about Log Streaming to Amazon S3.

Appian Cloud environments can be configured to stream supported logs, in real time, to your own syslog receiver. Once logs are stored in a central repository, you can index, access, search, and correlate events using your existing Log Management and Security Information and Event Management (SIEM) tools.

This service operates on a push-based model, in which Appian Cloud environments are configured to send a stream of logs to your syslog receiver. Logs are forwarded in real-time as the messages are written in the Appian Cloud environment.

These logs can be further digested and aggregated by tools of your choice, such as Splunk, LogRhythm, and Elasticsearch-Logstash-Kibana (ELK) stack.

Benefits

With this service enabled on your Appian Cloud environment, you can integrate the information contained in the logs for a consolidated view of your enterprise operations. Some benefits of this service include:

  • Simplified log management: You can easily consume your logs from a centralized location.
  • Faster diagnosis and troubleshooting of your enterprise applications: You benefit from increased visibility of debugging messages. For example, you can expose these messages to Appian designers and system administrators to quickly resolve application-level incidents as soon as they are generated.
  • Improved system visibility: You can assess historic performance by aggregating system metrics over time. This allows you to visualize, identify, and predict patterns in the demand of your enterprise applications.
  • Integrated security analytics: You can continuously monitor for login activity to your Appian Cloud environment. By integrating with other enterprise systems, you can audit and correlate patterns in a unified platform.

Setup

Log streaming supports the transmission of messages to either a self-hosted syslog receiver or a Sumo Logic Cloud Syslog Source.

Self-Managed Syslog Receiver (IPsec VPN Tunnel)

The figure below shows an example of the message flow between your Appian Cloud environment and a self-hosted syslog receiver in your network using an IPsec VPN tunnel.

images:Log_Streaming.png

Log transmission is performed over an IPsec VPN tunnel established to your network. As an additional security layer, syslog messages can be encrypted using a TLS certificate installed on the syslog receiver that you provide. TLS encryption is enabled by default but can be disabled upon your request.

The figure below shows an example of the message flow between your Appian Cloud environment and a self-hosted syslog receiver in your network using AWS PrivateLink.

images:Log_Streaming_PrivateLink.png

Log transmission is performed using an AWS PrivateLink connection established to your network. Syslog messages are encrypted with TLS using a trusted public CA-signed certificate that you install on your own syslog receiver.

Self-Managed Syslog Receiver (TLS 1.2)

The figure below shows an example of the message flow between your Appian Cloud environment and a self-hosted syslog receiver over the public internet using TLS 1.2.

images:Log_Streaming_TLS.png

Log transmission is performed using TLS 1.2 with TCP and syslog messages are encrypted using a publicly trusted CA-signed certificate that you install on your syslog receiver.

Sumo Logic Cloud Syslog Source

The figure below shows an example of the message flow between your Appian Cloud instance and a Sumo Logic Cloud Syslog Source.

sumo_logic.png

For a Sumo Logic Cloud Syslog Source, log transmission is performed over the internet and syslog messages are encrypted with TLS using the trusted public CA-signed certificate provided by your Sumo Logic deployment.

Supported logs

The following logs can be forwarded to your syslog receiver. Select a tab to view the logs for that category. Each row describes a single log file:

  • Log: The name of the log file (without extension), linked to its detailed description on the System Logs page.
  • Format: The file extension (.csv or .log).

To add or remove logs from streaming, open a support case.

Log Format Tag
admin_console_audit .csv admin-console-audit:
admin_console_user_start_pages_audit .csv admin-console-user-start-pages-a:
ai_guardrail_violations .csv ai-guardrail-violations:
authz-audit .csv authz-audit:
blocked_files .csv blocked-files:
deletion .log deletion:
design_objects .csv design-objects:
forgot_password_requests .csv forgot-password-requests:
group_management .csv group_management:
login-audit .csv login-audit:
logout-audit .csv logout-audit:
password_resets .csv password-resets:
rdbms-audit .log rdbms-audit:
records_usage .csv records-usage:
saml_failed_logins .csv saml-failed-logins:
secure_credentials_store .csv secure-credentials-store:
sites_usage .csv sites-usage:
task_errors .csv task-errors:
unscanned_files .csv unscanned-files:
user_management .csv user-management:
username_changes .csv username-changes:
Log Format Tag
system .csv system-metrics:
Log Format Tag
ads_call_trace .csv ads-call-trace:
ai_input_output_activity .log ai-input-output-activity:
artificial_intelligence .csv artificial-intelligence:
data_store_details .csv data-store-details:
data_store_summary .csv data-store-summary:
engine_call_summary .csv engine-call-summary:
engine_summary .csv engine-summary:
event_consumer_details .csv event-consumer-details:
event_consumer_summary .csv event-consumer-summary:
expressions_details .csv expressions-details:
integration_details .csv integration-details:
interface_query_record_type_details .csv interface-query-record-details:
perf_monitor_rdbms .csv perf-monitor-rdbms:
perf_monitor_rdbms_slow .csv perf-monitor-rdbms-slow:
query_record_type_details .csv query-record-type-details:
sail_details .csv sail-details:
sail_summary .csv sail-summary:
sail_trace .csv sail-trace:
stored_procedures_slow .csv stored-procedures-slow:
web_api_details .csv web-api-details:
web_api_summary .csv web-api-summary:
work_poller_details .csv work-poller-details:
Log Format Tag
ads_call_trace .csv ads-call-trace:
appender-gateway .log appender-gateway:
appianusername-ipaddress-tomcat-access .log appianusername-ipaddress-tomcat:
data-server-client-errors-detail .log data-server-client-error-detail:
deployment .log deployment:
design_errors .csv design-errors:
jidoka .log jidoka:
rts-slow-queries-* .log rts-slow-queries:
tomcat-access .log tomcat-access:
tomcat-stdOut .log tomcat-logs:

Message format

Syslog messages have the following format:

1

<PRI> <TIMESTAMP> <HOSTNAME> <TAG> <MESSAGE>
  • PRI: Specifies the priority of the syslog message (RFC5424)
  • TIMESTAMP: Date and time of the message. The value will be expressed in the timezone configured on your syslog receiver.
  • HOSTNAME: Appian Cloud instance name.
  • TAG: Message tag depending on the log file.
  • MESSAGE: Complete log message generated by the Appian component. Messages also contain timestamps expressed in Greenwich Mean Time Zone (GMT).

Prerequisite checklist

Prerequisite Description Organizational Role
Professional or Signature Success Plans Order Form This offering is available via Professional or Signature Success Plans. Business relationship owner
Update to a current Appian version Appian Cloud environments with this feature enabled should be running a supported Appian version per the Support Policy. Authorized Support Contact
Set up an IPSec VPN Tunnel, AWS PrivateLink, or TLS 1.2 connection (Only required for self-hosted syslog receivers) For self-hosted syslog receivers you are required to establish an IPSec VPN Tunnel, AWS PrivateLink, or TLS 1.2 connection to your network which will allow connectivity to your syslog receiver. Both Static and Dynamic IPSec VPN tunnels are compatible with log streaming. Refer to Cloud VPN Integration documentation, Dynamic VPN Integration documentation, or Cloud PrivateLink Integration documentation for detailed steps. Network Administrator / Authorized support contact
Set up syslog receiver For Sumo Logic Cloud Syslog Source:
  • Configure a Cloud Syslog Source in your account (refer to the documentation for details)
For Self-Managed Syslog Receiver:
  • The syslog receiver is required to listen for messages over TCP (UDP is not supported)
  • By default, the syslog clients running in your Appian Cloud environment will attempt to connect to your syslog receiver using TLS. You will need to enable TLS on your syslog receiver and install a valid publicly trusted CA-signed certificate. You may only use a certificate signed by a private CA or a self-signed certificate when using an IPSec VPN tunnel to connect to your syslog receiver
  • Upon your request, Appian can disable TLS encryption only for self-hosted syslog receivers using IPsec VPN tunnels. This setting is not recommended as logs would travel in clear text in your network after the syslog traffic leaves the VPN device
 Server/Network Administrator

Steps

Once all prerequisites have been completed, you can follow these steps to enable log streaming in your Appian Cloud environment:

  1. Open a Support Case requesting for enabling this service in your Appian Cloud environment. Provide the following details:
    1. Syslog receiver target
      • For self-hosted syslog receivers using IPsec VPN, you will provide a private IP address or hostname that is part of your private network space.
      • For self-hosted syslog receivers using AWS PrivateLink or TLS 1.2, you will provide the hostname of your syslog receiver.
      • For Sumo Logic, you provide the endpoint hostname.
    2. Port
    3. Token (Sumo Logic only). You need to provide the token that is generated during the setup process. This information should be provided to Appian Support over the phone or in-person to be consistent with good security practices.
  2. Appian Support will schedule a maintenance window and deploy the necessary configurations.
  3. After the maintenance window, your Appian Cloud environment will start forwarding logs to your syslog receiver.

Feedback