How to Configure a Custom Syslog Server for 3CX

Introduction

The Custom Syslog Server option allows you to send 3CX system events and audit logs to any standard syslog collector (such as rsyslog, syslog-ng, or Kiwi Syslog). This is typically used for on-premise logging servers or security information and event management (SIEM) systems within your local network.

Step 1: Prepare your Syslog Server

Before configuring 3CX, ensure your destination syslog server is ready to receive external traffic.

  • Identify the IP/Hostname: Note the internal or external IP address of your logging server.
  • Open Firewall Ports: Ensure the server’s firewall allows incoming traffic from your PBX on your chosen port (usually 514 for standard syslog).
  • Enable Remote Reception: Confirm your syslog service (e.g., rsyslog) is configured to "listen" for remote messages, as many are set to local-only by default.
  • Check out the “Installing Rsyslog on Debian” section below to get started.

Step 2: Configure 3CX Remote Syslog

  • In the 3CX Admin Console, navigate to “Admin” > “Integrations” > “Remote Syslog”.
  • Set the “Remote Logging Provider” dropdown to “Custom Syslog Server”.
  • Syslog Server Address: Enter the IP address or the Fully Qualified Domain Name (FQDN) of your server.
  • Port: Enter the port number your server is listening on (default is 514, but check your server configuration).
  • Transport Protocol: Select the protocol required by your server:
  • UDP: The most common for syslog; fast but does not guarantee delivery.
  • TCP: More reliable as it confirms packet receipt.
  • TLS: Encrypts the logs during transit (requires a valid certificate on the receiving end).
  • mTLS: In case you select TLS, optionally upload required client certificate and key if your syslog server is configured to also verify the PBX
  • Under the “Data to Export” section, select the desired logs:
  • System Alerts: Critical system resource utilization and health issues(Requires alert thresholds to be enabled and configured in Admin > System > Alerts).
  • 3CX Alerts: PBX-specific events such as trunk status, stopped services or IP blacklisting.
  • Audit Logs: A history of settings changed by administrators.
  • Click “Save” at the top of the page.

Step 3: Verify the Connection

  • Click the Test button at the top of the 3CX Remote Syslog page. 3CX will send a standardized test message to your server.
  • On your syslog server, check your log files (e.g., /var/log/syslog on Linux) to confirm the arrival of the test message. It will typically appear with a 3CX Hello identifier.

If, for example, you want to monitor your syslog server messages for incoming messages from "mypbx.3cx-example.com":

root@mysyslog.3cx-example.com:~# tail -f /var/log/syslog | grep mypbx.3cx-example.com

2026-05-21T10:55:52+03:00 mypbx.3cx-example.com SyslogIntegrationTest 3CX says 'hello' to Custom

2026-05-21T11:05:47+03:00 mypbx.3cx-example.com EventLog {"id":257,"timestamp":"2026-05-21T08:05:47.0770000Z","message":"3CX Transcription Engine connection lost – transcription of voicemails and calls suspended","template":"3CX Transcription Engine connection lost – transcription of voicemails and calls suspended","params":[""],"source":"Web Manager","type":2,"event_id":50042,"group_name":"System wide"}

2026-05-21T11:16:50+03:00 mypbx.3cx-example.com SyslogIntegrationTest 3CX says 'hello' to Custom

Custom Parameters for Advanced Deployments

For environments where the defaults don't quite fit, 3CX exposes the parameter SYSLOG_MESSAGE_FORMAT.

3CX supports both major Syslog standards and you can switch between them. By default, 3CX uses RFC5424 - the modern, more structured format that most current SIEMs prefer.

If your collector is older or you're standardizing on a legacy format, set the parameter to RFC3164 and 3CX will format outgoing messages accordingly. For reference, here's what each format looks like in practice:

  • RFC3164: <191>Dec 10 11:59:56 mypbx.3cx-example.com SyslogIntegrationTest: 3CX says 'hello' to SyslogServer
  • RFC5424: <191>1 2026-01-15T14:06:50+02:00 mypbx.3cx-example.com SyslogIntegrationTest - - - 3CX says 'hello' to SyslogServer

In both cases, <191> is the message priority, the timestamp is in UTC, mypbx.3cx-example.com is the PBX FQDN, and the application tag indicates the source of the event. Possible application tags include SyslogIntegrationTest, EventLog, AuditLog and Telemetry. Everything after that is the message payload.

Installing Rsyslog on Debian

  1. SSH to your Debian Machine and run the following commands to Install and enable rsyslog

sudo apt update

sudo apt install rsyslog

sudo systemctl enable rsyslog

sudo systemctl start rsyslog

  1. Edit the main rsyslog configuration file

nano /etc/rsyslog.conf

  1. Add or uncomment the following lines depending on the protocol you want to support and save the file (i.e UDP/TCP)

# provides UDP syslog reception

module(load="imudp")

input(type="imudp" port="514")

# provides TCP syslog reception

module(load="imtcp")

input(type="imtcp" port="514")

  1. Restart the rsyslog service for the changes to take effect:

sudo systemctl restart rsyslog

Last Updated
This document was last updated on 21 May 2026
https://www.3cx.com/docs/custom-syslog-server/