> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Syslog Integration

> Transfers Apinizer logs to external SIEM systems via syslog protocol and provides centralized log management.

## Logging Categories

Apinizer's logging mechanism is primarily divided into two main categories:

<CardGroup cols={2}>
  <Card title="Traffic Logs" icon="network-wired">
    Contains all API traffic information passing through Apinizer and is recorded by default in <strong>Elasticsearch</strong>.
  </Card>

  <Card title="System Logs" icon="server">
    Records system-related operations and events. These are stored by default in the <strong>MongoDB</strong> database.
  </Card>
</CardGroup>

## System Log Subcategories

System Logs are divided into five subcategories. Three of these can be sent to an external product via Syslog:

<Tabs>
  <Tab title="Logs That Can Be Sent via Syslog">
    <ul>
      <li><strong>Audit Log (System Operations)</strong>: Logs related to changes and operations made in the Apinizer management application.</li>
      <li><strong>Token Log</strong>: Contains logs related to token acquisition when Apinizer is used as a token provider.</li>
      <li><strong>Application Log</strong>: Software logs of Apinizer applications/modules. By default, kept at error (Error) level, and users can change the level as needed.</li>
    </ul>
  </Tab>

  <Tab title="Logs Not Sent via Syslog">
    <ul>
      <li><strong>Test Console Audit</strong>: Audit logs related to the use of the Test Console in the Apinizer management application interface. Not sent to external syslog products.</li>
      <li><strong>Login Audit</strong>: Log records of successful and failed login attempts to the Apinizer management application interface. Not sent to external syslog products.</li>
    </ul>
  </Tab>
</Tabs>

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="What are the challenges when sending logs to a SIEM product like QRadar?">
    Parameters in JSON format logs need to be parsed by writing a parser and stored accordingly. Therefore, it is necessary to work together with people who manage/use the Apinizer product or are familiar with web services to determine important fields for the organization together.

    In some cases, the length of log records that can be received at once can also be a problem. In such cases, when opening syslog integration, it can be configured to send only up to a certain number of characters in the body field.
  </Accordion>

  <Accordion title="Do System Audit logs coming via Syslog cover User Audit logs?">
    No, <strong>System Audit logs</strong> that can be sent via Syslog and the mentioned <strong>User Audit logs</strong> have different content:

    <ul>
      <li><strong>System Audit Logs</strong>: "Who did what on which page" - general logs related to changes made on the system.</li>
      <li><strong>User Audit Logs</strong>: There is no separate "user audit" log under this definition externally. Generally, user-focused audits are handled under special category logs such as <strong>Login Audit</strong> and <strong>Test Console Usage Audits</strong>, and these are not currently sent to external applications.</li>
    </ul>
  </Accordion>
</AccordionGroup>

## Log Transfer Configuration

To transfer API traffic and system logs to syslog, you can visit the following pages:

<CardGroup cols={2}>
  <Card title="Traffic Log Transfer" icon="network-wired" href="/en/operations/administrator-guides/traffic-logs-syslog-transfer">
    Traffic log transfer settings to syslog
  </Card>

  <Card title="System Log Transfer" icon="server" href="/en/operations/administrator-guides/system-logs-syslog-transfer">
    System log transfer settings to syslog
  </Card>
</CardGroup>