Adding Sophos Firewall (XG) via Syslog

Updated October 22, 2026 12:00

Purpose

This guide explains how to forward Sophos Firewall (XG and XGS series, SFOS) logs to Logsign USO over syslog. The integration covers firewall, web filter, application filter, IPS, anti-virus, anti-spam (SMTP), authentication and system events. Logsign parses the messages natively and normalizes them under Vendor Sophos, Product XG.

Prerequisites

An administrator account on the Sophos Firewall web admin console that can add syslog servers.
Network connectivity from the firewall to the Logsign USO collector on your syslog port (UDP or TCP 514 by default).
The IP address that the firewall uses as the source of its syslog traffic, so the source can be added in Logsign USO.

Step 1: Configure syslog forwarding on Sophos Firewall

Menu names differ between SFOS releases. In most versions the syslog server is added under System services > Log settings. If the path does not match your console, check the Sophos Firewall documentation for your version.

Add a new syslog server and enter the IP address of the Logsign USO collector, the syslog port and the protocol.
Leave the log format at the device standard format. Logsign reads the key=value pairs that this format produces.
Save the server, then enable the log types you want to collect for it in the log settings table. To collect mail events, enable the anti-spam (SMTP) logs in addition to the firewall and security logs.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select Sophos as the vendor and XG as the product, and enter the IP address of the firewall as the host. Click Save. Once the firewall starts sending, events appear under Search.

Supported message formats

Logsign accepts both log formats that Sophos Firewall has used over time. Older SFOS releases send the event time in separate date= and time= fields and use field names such as from_email_address and mailsize. Newer releases send log_version=1, an ISO 8601 timestamp= with a time zone offset, and renamed fields such as sender, recipient and email_size. You do not need to change anything on the firewall or in Logsign for either format.

An anti-spam SMTP message in the newer format looks like this (anonymized):

<30>device_name="fw-node01.example.local" timestamp="2026-10-20T14:43:49+0200" device_model="XGS5500" device_serial_id="X55010F000000000" log_id="041101618035" log_type="Anti-Spam" log_component="SMTP" log_subtype="Allowed" log_version=1 severity="Information" fw_rule_id="474" fw_rule_name="Auto added firewall policy for MTA" fw_rule_section="Local rule" policy_name="None" sender="journal@example.local" recipient="journal@example.de" subject="Your request at Example CRM:0804976" message_id="1xJ9C1-000000002PC-1bRW-1792500229" email_size=232587 action="QUEUED" reason="Email has been accepted by Device and queued for scanning." src_host="example.local" src_ip="203.10.113.48" src_country="DEU" protocol="TCP" src_port=14390 quarantine_reason="Other" src_zone_type="WAN" src_zone="WAN"

A message is parsed by this integration only when it contains a timestamp= or a date= field. Fields with the value - or N/A are skipped.

Notes and limits

The quarantine_reason field of anti-spam messages is not mapped to a normalized field.
If email_size or mailsize is not a number, Mail.Size is stored as 0.
Messages whose message ID has no classification are still collected and searchable, but they show as Uncategorized Event because no EventMap applies to them.

Verification

In Logsign USO, open Settings > Data Collection and confirm that the Sophos XG source is receiving data.
Go to Search and look for events with Vendor Sophos and Product XG. Firewall traffic should appear with Source.IP, Destination.IP and Rule.Name filled.
Send a test mail through the firewall MTA. The anti-spam event should appear with Event.Type Anti-Spam, Event.Category SMTP, and the sender, recipient, subject and size in the Mail fields.
If the source is receiving data but the events carry no Vendor value, the messages are not in a format this integration recognizes. Check that the syslog server on the firewall uses the device standard format and that no relay on the path rewrites the message body.