Overview
VanDyke VShell Server is an SSH2/SFTP server for Windows. This article explains how to forward VShell Server logs to Logsign Unified SecOps Platform via syslog for security analytics and forensic purposes.
Prerequisites
- All Logsign versions support this integration.
Configure On VanDyke VShell Server
Unverified: the exact console menu path for enabling syslog logging has not been verified against a live VShell Server console during this research. Consult VanDyke's own VShell Server administration guide for your version.
- In the VShell Server administration console, enable logging to a syslog server and point it at your Logsign collector's IP address and port.
- Confirm the log format is left at VShell's default (space-delimited, one line per event); Logsign's parser expects this default layout rather than a custom log format.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select VanDyke as the vendor, and VShell Server as the product.
| Field | Description |
|---|---|
| Host | IP address of the VShell Server sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once VShell Server is forwarding syslog to the configured host/port, events should begin appearing under Search.
Log Format and Supported Events
Logsign recognizes VShell Server's default space-delimited syslog line, for example:
2026-08-01 12:00:00 hostname conn 4118957 192.168.1.1 51234 - - - 0 5000 3000 0 10.0.0.5 22 "4118957: Connection accepted from 192.168.1.1:51234"The parser recognizes the following VShell event categories out of the box, mapped to Logsign's normalized Context/Type/SubType schema:
- auth / authaccepted / authrejected: authentication attempts, successful logins, and rejected logins.
- conn: connection accepted, connection closed, and session channel open events, plus the corresponding session logout.
- sftp: SFTP file operations.
Each event carries the source user, command, source and destination IP with city/country geo enrichment, source port, session ID, object name/path (for file operations), status code, and byte counts (sent/received/total). Event types not covered above fall back to a generic classification rather than being dropped.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, Destination IP, Source User, Event Info, etc.) are populating correctly.