--- title: Set up network syslog monitoring source: https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/network-syslog-monitoring --- You can use our guided install process to install the syslog monitoring agent, or install the agent manually. This doc covers prerequisites to start this install process and a step-by-step walk through of your install options. ## Prerequisites [#prerequisites] Before you can start, you'll need to [sign up for a New Relic account](https://newrelic.com/signup). If you choose to install the agent manually, you also need: - A New Relic [account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/account-id). - A New Relic license key. **Docker prerequisites** We recommend using a Docker container to deploy the agent for syslog message collection. To use it, you need: - [Docker](https://docs.docker.com/engine/install) installed in a Linux host - Ability to launch new containers via command line **Podman prerequisites** If you're using a Podman container to launch the agent, you need: - [Podman](https://podman.io/docs/installation) installed in a Linux host - Ability to launch new containers via command line **Linux host prerequisites** If you're using Linux to install the agent as a service, you need: - SSH access to the host - Access to install/remove applications and services - One of these supported operating systems: - Debian 12 (Bookworm) - Debian 11 (Bullseye) - Debian 10 (Buster) - RedHat Enterprise Linux 9 - Ubuntu 20.04 (Focal LTS) - Ubuntu 22.04 (Jammy LTS) - Ubuntu 24.04 (Noble LTS) > #### ⚠️ IMPORTANT > > To receive syslog messages, the agent must bind to UDP 514. In a host-based install, the following command will be included during the install process. When executed, KTranslate will be run with elevated privileges. > > ```shell > sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate > ``` **Network syslog devices prerequisites** > #### ⚠️ IMPORTANT > > `ktranslate` handles syslog in the following formats automatically: [RFC3164](https://datatracker.ietf.org/doc/html/rfc3164), [RFC5424](https://datatracker.ietf.org/doc/html/rfc5424), and [RFC6587](https://datatracker.ietf.org/doc/html/rfc6587). Any messages received outside of these formats will be discarded unless you configure the [`-syslog.format=NoFormat`](https://docs.newrelic.com/docs/network-performance-monitoring/advanced/ktranslate-container-management/#container-runtime-options) flag at runtime. You must configure source devices to send syslog messages to the host running the network monitoring agent. Here's how to configure network syslog export in some devices (this is not an all-inclusive list): - [Checkpoint - Security Gateway](https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMonitoring_AdminGuide/Topics-LMG/Working-with-Syslog-Servers.htm). You must sign in to the User Center/PartnerMAP checkpoint. - [Cisco - ASA](https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html) - [Cisco - IOS](https://community.cisco.com/t5/networking-documents/how-to-configure-logging-in-cisco-ios/ta-p/3132434) - [Cisco - NX-OS](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_5syslog.html) - [F5 - BIG-IP](https://support.f5.com/csp/article/K13080) - [Fortinet Fortigate](https://help.fortinet.com/fadc/4-5-1/olh/Content/FortiADC/handbook/log_remote.htm) - [Juniper - Junos](https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/syslog-edit-system.html) - [Palo Alto - PAN-OS](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring.html) **Network security prerequisites** Check the [network security prerequisites for network syslog](/install/npm). ## Set up network syslog monitoring in New Relic [#setup-network-syslog-monitoring] For most use cases, we recommended our guided install to set up network flow data monitoring. If your set up is more advanced with custom configurations, then we'd recommend installing manually. **Set up with the guided install** 1. Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Add more data**. 2. Scroll down until you see **Network** and click **Syslog**. 3. Follow the steps outlined in the guided installation process. You can use Docker or Linux. [Add network syslog data](https://one.newrelic.com/nr1-core?state=cb5cc243-9406-375a-fc7e-176ed282565c) ![A screenshot depicting the syslog guided installation process](https://docs.newrelic.com/images/network_screenshot-full_syslog-guided-install.webp "Syslog guided installation") **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Add more data > Network > Syslog** to set up syslog message monitoring. 4. Investigate your device syslog messages in the New Relic log management UI, using the following query: ```sql "plugin.type":"ktranslate-syslog" ``` Here's a short video (2:56 minutes) showing how to set up network syslog monitoring: [Video](https://www.youtube.com/embed/8cNJFt2L9M8) **Manual container setup** Before reading about installing the syslog agent manually, consider using our guided install process to avoid errors: [Add network syslog data](https://one.newrelic.com/nr1-core?state=cb5cc243-9406-375a-fc7e-176ed282565c) ### Docker container 1. On a Linux host with Docker installed, download the **ktranslate** image by running one of the following: - [Docker Hub](https://hub.docker.com/): ```shell docker pull kentik/ktranslate:v2 ``` - [Quay.io](https://quay.io/): ```shell docker pull quay.io/kentik/ktranslate:v2 ``` 2. Copy the `snmp-base.yaml` file to the local `$HOME` directory of your Docker user, and discard the container by running: ```shell cd ~ id=$(docker create kentik/ktranslate:v2) docker cp $id:/etc/ktranslate/snmp-base.yaml . docker rm -v $id ``` 3. Edit the `snmp-base.yaml` file, and add your syslog devices inside the `devices` dictionary key with the following structure: ```yaml devices: # This key and the corresponding 'device_name' # need to be unique for each device syslog_device1: device_name: syslog_device1 device_ip: x.x.x.x/yy ping_only: true # Optional user tags user_tags: owning_team: net_eng environment: production ``` > #### ⚠️ IMPORTANT > > If you're already monitoring SNMP data devices that will also network syslog messages, you'll want to ensure that the value for `device_name` is identical for both configuration files to ensure the syslog messages are attributed to the right entity in the New Relic UI. 4. Run `ktranslate` to listen for network flows with the command: ```shell docker run -d --name ktranslate-$CONTAINER_SERVICE \ --restart unless-stopped --pull=always -p 514:5143/udp \ -v `pwd`/snmp-base.yaml:/snmp-base.yaml \ -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \ kentik/ktranslate:v2 \ -snmp /snmp-base.yaml \ -nr_account_id=$YOUR_NR_ACCOUNT_ID \ -metrics=jchf \ -tee_logs=true \ -dns=local \ # Use this field to create a unique value for `tags.container_service` inside of New Relic -service_name=$CONTAINER_SERVICE \ nr1.syslog ``` > #### 💡 TIP > > The default port the container listens for syslog messages on is `514/udp`. If your messages are being sent over a different port, you'll need to change the argument `-p 514:5143/udp` to `-p $srcPort:5143/udp`. 5. Investigate your device syslog messages in the New Relic log management UI, using the following query: ```sql "plugin.type":"ktranslate-syslog" ``` ### Podman container 1. On a host with Podman installed, download the **ktranslate** image by running the following command: - [Docker Hub](https://hub.docker.com/): ```shell podman pull docker.io/kentik/ktranslate:v2 ``` 2. Copy the `snmp-base.yaml` file to the local `$HOME` directory of your Podman user, and discard the container by running: ```shell cd ~ id=$(podman create kentik/ktranslate:v2) podman cp $id:/etc/ktranslate/snmp-base.yaml . podman rm -v $id ``` 3. Edit the `snmp-base.yaml` file, and add your syslog devices inside the `devices` dictionary key with the following structure: ```yaml devices: # This key and the corresponding 'device_name' # need to be unique for each device syslog_device1: device_name: syslog_device1 device_ip: x.x.x.x/yy ping_only: true # Optional user tags user_tags: owning_team: net_eng environment: production ``` > #### ⚠️ IMPORTANT > > If you're already monitoring SNMP data devices that will also send network syslog messages, you'll want to ensure that the value for `device_name` is identical for both configuration files to ensure the syslog messages are attributed to the right entity in the New Relic UI. 4. Rootless Podman containers aren't able to bind to ports under 1024. To handle packet redirection for your syslog messages, you'll need to create an `iptables` rule that targets the port your packets are arriving on UDP (`$scrPort`) with the command: ```shell sudo iptables -t nat -A PREROUTING -p udp --dport $scrPort -j REDIRECT --to-port 5143 ``` 5. Run `ktranslate` to listen for syslog messages with the command: ```shell podman run -d --name ktranslate-$CONTAINER_SERVICE \ --userns=keep-id --restart unless-stopped --pull=always --net=host \ -v `pwd`/snmp-base.yaml:/snmp-base.yaml \ -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \ kentik/ktranslate:v2 \ -snmp /snmp-base.yaml \ -nr_account_id=$YOUR_NR_ACCOUNT_ID \ -metrics=jchf \ -tee_logs=true \ -dns=local \ -service_name=ktranslate-$CONTAINER_SERVICE \ nr1.syslog ``` 6. Investigate your device syslog messages in the New Relic log management UI, using the following query: ```sql "plugin.type":"ktranslate-syslog" ``` ### Linux service 1. Depending on your package manager, use one of the commands below to install `ktranslate`: - Yum: ```shell curl -s https://packagecloud.io/install/repositories/kentik/ktranslate/script.rpm.sh | sudo bash && \ sudo yum install ktranslate ``` - Apt: ```shell curl -s https://packagecloud.io/install/repositories/kentik/ktranslate/script.deb.sh | sudo bash && \ sudo apt-get install ktranslate ``` 2. Define the environment variables used by `ktranslate`: ```shell sudo tee "/etc/default/ktranslate.env" > /dev/null <<'EOF' NR_ACCOUNT_ID=$YOUR_NR_ACCOUNT_ID NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY KT_FLAGS="-snmp /etc/ktranslate/snmp-base.yaml \ -metrics=jchf \ -tee_logs=true \ -dns=local \ -service_name=$CONTAINER_SERVICE \ -syslog.source=0.0.0.0:514 \ nr1.syslog" EOF # ensure /etc/default/ktranslate.env is owned by ktranslate user sudo chown ktranslate:ktranslate /etc/default/ktranslate.env # Syslog binds to privileged port 514. Allow ktranslate to bind to this point with the following command sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate ``` 3. If you don't have an existing `snmp-base.yaml` configuration file, create one with: ```shell cd ~ touch snmp-base.yaml ``` 4. Edit the `snmp-base.yaml` file, and add your syslog devices inside the `devices` dictionary key with the following structure: ```yaml devices: # This key and the corresponding 'device_name' # need to be unique for each device syslog_device1: device_name: syslog_device1 device_ip: x.x.x.x/yy ping_only: true # Optional user tags user_tags: owning_team: net_eng environment: production ``` 5. Restart the `ktranslate` service to apply your changes to the `snmp-base.yaml` file: ```shell sudo systemctl restart ktranslate ``` 6. Investigate your device syslog messages in the New Relic log management UI, using the following query: ```sql "plugin.type":"ktranslate-syslog" ``` ## What's next? [#whats-next] You can set up some additional agents to complement your network syslog data: - To get better visibility into your network device performance, [set up SNMP data monitoring](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/snmp-performance-monitoring). - To get better visibility into how your network is being used, [set up network flow data monitoring](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/network-flow-monitoring).