Adding ManageEngine PAM360 via Syslog

Purpose

This guide explains how to forward ManageEngine PAM360 audit events to Logsign USO over syslog and what Logsign does with them. The integration covers the two audit trails that PAM360 writes to syslog: user audit events (logins, logouts and failed authentication attempts on the PAM360 console) and resource audit events (password retrievals and remote sessions that a PAM360 user opens to a managed resource).

Prerequisites

• A PAM360 administrator account that is allowed to change the syslog forwarding settings.
• Network connectivity from every PAM360 server to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
• The Logsign user account that will add the data source needs access to Settings > Data Collection.

Step 1: Forward PAM360 audit logs to Logsign

PAM360 sends its audit trail through its own syslog forwarding settings. Menu names differ between PAM360 releases, so use the ManageEngine PAM360 documentation for your version to find the syslog server settings. In that configuration, add the IP address of the Logsign USO collector and the syslog port. If your version lets you choose which audit trails are forwarded, include both user audit and resource audit events. Keep the default PAM360 message format.

If PAM360 runs on more than one application server (for example in a high availability setup), configure forwarding on each server. Each server is recorded with its own host name, so you can tell which node handled an event.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select ManageEngine as the vendor and PAM 360 as the product, and enter the IP address of the PAM360 server as the host. Repeat this for every PAM360 server that sends logs. Click Save. Once PAM360 starts sending, events appear under Search.

Supported message format

Every PAM360 audit message has the same layout after the syslog header: the audit type, the PAM360 user who performed the operation and the client IP address separated by colons, then the event name, the PAM360 timestamp, the result, the PAM360 server name, and finally the account and a free text description. Resource audit messages also carry the resource name in front of the account. Three typical events look like this (anonymized):

Oct 20 11:21:23 PAMAPP02 UserAudit:N/A:10.0.0.10 User_Logged_in_-_AD 2026/10/20 11:21:20 Success PAMAPP02 Non-MSP-John_DOE:Authenticated_by_AD_and_Google_Authenticator

Oct 20 11:26:27 PAMAPP01 UserAudit:N/A:10.0.0.10 User_Authentication_Failed 2026/10/20 11:26:24 Failure PAMAPP01 Non-MSP-John_DOE:AD_Authentication_in_CORP.EXAMPLE.LOCAL@MSP_domain

Oct 20 15:04:36 PAMAPP01 ResourceAudit:PAMAdmin1:10.0.0.11 Session_Started 2026/10/20 15:04:33 Success PAMAPP01 SCANNER_2:svc_scanner:N/A:RDP_initiated_from_PAM360_to_10.0.0.20

In user audit messages the second header value is N/A and the account at the end of the line is the PAM360 user. In resource audit messages the second header value is the PAM360 user who performed the operation, and the account at the end of the line is the target account on the managed resource.

Notes and limits

• Destination.IP is filled only when the description ends with an IPv4 address. When the resource is reached by host name, the host name stays in Event.Description and Destination.IP is empty.
• Only the event names in the table above are classified. Any other PAM360 audit event, including a login event written under a different event name, stays on Network / Other / Info (60701). Use Event.Type and Event.Action to filter them.
• If PAM360 resource sessions still show the target account in Source.UserName, or failed authentication attempts still arrive as Network / Other / Info, the appliance is running an older version of the ManageEngine PAM 360 plugin. Contact Logsign support to confirm the version you need.
• The event severity comes from the classification table, not from the syslog priority of the incoming message.

Verification

After both sides are saved, a login and one remote session through PAM360 are enough to check the integration end to end.

• In Logsign USO, open Settings > Data Collection and confirm that the PAM360 source is receiving data.
• Log in to the PAM360 console. In Search, look for events with Vendor ManageEngine and Product PAM 360. The login should appear with EventMap Identity / User / Login and your PAM360 user name in Source.UserName.
• Enter a wrong password once. That attempt should appear as Identity / User / Deny with Event.Action Failure and severity warning.
• Open a remote session to a managed resource from PAM360. The Session_Started event should show your PAM360 user in Source.UserName and the target account and resource in Destination.UserName and Destination.HostName.
• If the source is receiving data but no events show Vendor ManageEngine, the messages are not in a format this integration recognizes. Check that PAM360 is sending its default audit format and that nothing on the way rewrites the message.