Adding VeloCloud SD-WAN Edge via Syslog

Purpose

This guide explains how to forward the syslog stream of VeloCloud SD-WAN Edges (VMware SD-WAN, now Arista VeloCloud SD-WAN) to Logsign USO. The integration covers two kinds of messages that an Edge sends: stateful firewall logs (session open, close, deny, allow and update) and Edge events such as interface and link state changes, service failures, reboots, software updates, HA and VRRP state changes, USB activity and new client devices.

This syslog integration is separate from the VeloCloud SD-WAN Integration via API, which pulls Enterprise Alerts and Enterprise Events from the Orchestrator. You can use both at the same time. Firewall session logs are available only over syslog.

Prerequisites

• Access to the VeloCloud Orchestrator with permission to change Profile or Edge device settings.
• Network connectivity from each Edge to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
• A Logsign USO release that includes the VeloCloud SD-WAN Edge parser. Contact Logsign Support if you are not sure which release you run.

Step 1: Configure Syslog on the Edges

Syslog is configured in the Orchestrator, either on a Profile (applies to every Edge that uses it) or on a single Edge. Menu names can differ between Orchestrator releases, so check the "Configure Syslog Settings for Profiles" page of the VeloCloud SD-WAN Administration Guide for your release if the steps below do not match your console.

1. In the Orchestrator, go to Configure > Profiles (or Configure > Edges) and open the Device tab.
2. Under Telemetry > Syslog, add a syslog collector. Enter the IP address of the Logsign USO collector, choose UDP or TCP and set the port (514 by default).
3. Set Roles to EDGE AND FIREWALL EVENT. If you select only FIREWALL EVENT, Edge events are not sent.
4. Set the Syslog Level to INFO or lower. Firewall logs are sent at the INFO level.
5. To receive firewall logs from every segment, select All Segments.
6. You can keep the default facility and tag. The parser does not depend on a specific tag or facility.
7. Open the Firewall tab of the same Profile or Edge and turn on Syslog Forwarding. It is off by default, and without it no firewall logs are sent.
8. Save the changes.

Step 2: Add the Data Source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select VeloCloud as the vendor and SD-WAN Edge as the product, and enter the IP address that the Edge uses to send syslog as the host. Click Save. Repeat this for every Edge. Once an Edge starts sending, events appear under Search.

Supported Message Format

After the syslog priority, every message has a timestamp, the Edge host name, the syslog tag (velocloud.sdwan by default) and the message text. Both the ISO 8601 timestamp that current Edges send and the classic RFC 3164 timestamp are accepted:

2026-10-09T09:53:16+00:00 EDGE-01 velocloud.sdwan: ACTION=VCF Close aMWnGW+sS6Ciy8DpWn0aJQ SID=0324583661 SEGMENT=0 IN=SFP1 PROTO=TCP SRC=192.0.2.10 DST=10.0.0.5 SPT=37242 DPT=80 APPLICATION=AnonyTun DURATION_SECS=1 BYTES_SENT=627 BYTES_RECEIVED=4451 REASON=FIN-Received DEST_NAME=SFP1 SVLAN=31 DVLAN=0 DEST_DOMAIN=app.example.com FW_POLICY_NAME=POLICY-A SEGMENT_NAME=Global Segment
Dec 17 07:21:16 b1-edge1 velocloud.sdwan: ACTION=VCF Deny SEGMENT=0 IN="IFNAME" PROTO=ICMP SRC=10.0.0.1 DST=10.0.0.2 TYPE=8 FW_POLICY_NAME=test SEGMENT_NAME=Global Segment
2026-10-09T09:02:27+00:00 EDGE-03 velocloud.sdwan: EDGE_NEW_DEVICE: New or updated client device e2:86:58:9b:d0:de, ip 172.16.0.9, segId 1, hostname phone-01, os

Firewall logs start with ACTION=VCF <Action>. Edge releases before 4.3 omit ACTION= and start with VCF <Action>. Both forms are parsed. Edge events start with the event name followed by a colon, for example EDGE_DISK_READONLY:.

Notes and Limits

• With the stateful firewall, every allowed session produces an Open line and a Close line. Application, byte and duration values are only in the Close line, so base traffic reports on Close events. Take the Open lines into account when you plan EPS, and use a Data Policy to drop them if you do not need them.
• For Edge events, only the event name and the detail text are recorded. The only exception is EDGE_NEW_DEVICE. User names or IP addresses inside other Edge events (for example login events) are not written to separate fields.
• Enhanced Firewall Services (EFS) IDS/IPS alerts are not parsed into separate fields.
• Time.Generated is stored in UTC when the Edge sends an ISO 8601 timestamp with an offset. The RFC 3164 timestamp has no year and no time zone. If your Edges send that form, set the Edge clock to the same time zone as Logsign USO.
• The parser accepts any message with a syslog header (timestamp, host name and tag) from the host you add. Add only VeloCloud Edges to this source. If another device sends syslog from the same IP address, its messages are recorded as VeloCloud events with Event.VendorID 999.

Verification

• In Logsign USO, open Settings > Data Collection and confirm that the VeloCloud SD-WAN Edge source is receiving data.
• Generate traffic through the Edge that matches a firewall rule. In Logsign USO, go to Search and look for events with Vendor VeloCloud and Product SD-WAN Edge. You should see events with EventMap Network / Session / Open and Network / Session / Close, with Source.IP, Destination.IP and Rule.Name filled.
• If Edge events arrive but no firewall logs appear, check that Syslog Forwarding is on in the Firewall tab and that the syslog role is EDGE AND FIREWALL EVENT.
• If the source is receiving data but no events show Vendor VeloCloud, check that the source uses the SD-WAN Edge product.