Purpose
This guide explains how to send logs from Ubiquiti UniFi devices and the UniFi Network application to Logsign USO over syslog for security analytics and forensic purposes. Logsign recognizes several distinct UniFi log formats automatically from a single syslog source, so in most deployments you point your UniFi Network application and/or UniFi OS console (Dream Machine, Cloud Gateway, and similar) at one Logsign syslog collector and add one syslog source in Logsign; no separate device-type selection is required per format.
Logsign currently recognizes four distinct UniFi log types, each with its own event prefix:
| Log type | Source | Content | Event Prefix ID |
|---|---|---|---|
| UniFi Network | UniFi Network application (CEF export) | Client connect/disconnect/roaming, security events (IDS/IPS block, firewall policy block), VPN session open/close, admin logins, configuration changes | 4494 |
| UniFi Gateway | UniFi OS gateway devices (Dream Machine, Cloud Gateway, and similar) | Netfilter-based firewall log lines (accept/drop/reject/NAT rule matches) | 4555 |
| U6 Plus / UniFi OS console | Access points and UniFi OS console system log (DHCP, OpenVPN, IPsec, radio/module messages) | Access point radio events, DHCP lease activity, OpenVPN and IPsec tunnel open/close/error events, general UniFi OS console log lines | 4438 |
| UniFi AC Long-Range Access Point | Older-generation UniFi AP models | Legacy access point syslog format, structured event lines | 4212 |
Which of these you see depends on which UniFi devices and applications you point at Logsign. It is common to only receive UniFi Network and UniFi Gateway events (from a UniFi OS console running the Network application), without ever seeing the older AC Long-Range format.
Prerequisites
- Administrator access to the UniFi Network application (self-hosted controller, or the built-in console on a UniFi OS gateway device) and, if applicable, to the UniFi OS console's own system settings.
- Network reachability from your UniFi devices/controller to the Logsign collector on the syslog port you configure.
Step 1: Configure Remote Syslog on UniFi
Unverified: the exact menu path for enabling remote syslog was not independently verified against a live UniFi Network application or UniFi OS console during this research, and it has changed across UniFi Network application versions. Consult Ubiquiti's own documentation for your version before relying on the steps below, and confirm the exact location with a live console.
- In the UniFi Network application, look for a remote syslog or "Controller Configuration > System Log" style setting (commonly under Settings > System > Advanced, or Settings > System Log in older versions) and point it at your Logsign collector's IP address and syslog port. This is what produces the UniFi Network (CEF) event stream.
- On a UniFi OS console (Dream Machine, Cloud Gateway, and similar), look for a separate remote syslog setting under the console's own System settings (distinct from the Network application's setting in the previous step) to forward gateway/firewall and general system log lines. This is what produces the UniFi Gateway and U6 Plus / UniFi OS console event streams described above.
- For standalone access points not managed through a UniFi OS console, check whether the device itself exposes a remote syslog setting; older AC Long-Range access points are typically configured this way.
Step 2: Add the Source in Logsign
Add a syslog source for your UniFi device(s) in Logsign USO as you would for any syslog-based source, using the IP/hostname the traffic arrives from. Logsign matches incoming lines against the four formats above automatically based on their structure; no separate device-type selection is required beyond a standard syslog source.
What Gets Collected
UniFi Network (Prefix 4494)
Parsed from CEF-formatted syslog. Covers client session open/close, wireless roaming, configuration changes, and (once correctly classified) security-relevant events: IDS/IPS blocks with signature name and ID, firewall policy blocks with source/destination IP and port, and VPN session open/close with the connecting user. Client identity (name, IP, MAC, hostname), source/destination zone, and traffic direction are captured where the underlying CEF record includes them.
UniFi Gateway (Prefix 4555)
Parsed from netfilter-style firewall log lines (the same style used by Linux iptables/nftables logging, tagged with a UniFi rule name such as PREROUTING-DNAT-32). Captures source/destination IP, port, and MAC, protocol, interface, and the rule's action (accept, drop, reject, NAT) derived from the rule name.
U6 Plus / UniFi OS console (Prefix 4438)
Parsed from access point radio/module syslog and from general UniFi OS console log lines. Covers DHCP lease activity (address, MAC, hostname), OpenVPN and IPsec tunnel open/close/error events (peer address, username or certificate common name where present), and general console log entries.
UniFi AC Long-Range Access Point (Prefix 4212)
Parsed from this older AP model's own structured syslog format.
Notes and Limits
- This is a syslog-based, parser-only integration. There is no API poller or credential to configure on the Logsign side.
- UniFi device-side syslog configuration is outside Logsign's code and was not verified in this research; refer to Ubiquiti's own documentation for your UniFi Network application and UniFi OS console versions.
- Not every UniFi Network/Gateway event type is individually classified; unrecognized event codes fall back to a generic classification rather than being dropped.