Skip to main content
Before beginning, ensure your environment conforms to the following specifications:

​
HSM

  • firmware 7.10.1.x. This guide was validated on 7.10.1.4.
  • Two administrative identities with their passwords. The SLFW command requires two logins, so a single administrator cannot complete it alone.
  • Both identities must hold the Diagnostics:Syslog Settings permission, which grants configuration of log levels and syslog server information.
  • Access to the HSM management port, reachable over TLS. The SLFW command is not accepted on the production port.
Confirm the permission before you begin. Log in and inspect the PR token that the GUSR response returns. It lists effective permissions as Category:Right pairs, so look for Diagnostics: followed by Syslog Settings.

​
Collector host

  • A Linux host or container runtime that can run OpenTelemetry Collector Contrib. Validated on v0.159.0.
  • The Contrib distribution is required. The core distribution does not include the udplog receiver.
  • A free UDP port for the syslog listener. This guide uses 5515. Any port from 1 to 65535 works, and a port above 1024 avoids running the collector as root.
  • Outbound HTTPS on port 443 to Observe.

​
Observe

  • An Observe account. A free trial is sufficient for validation.
  • Your Observe customer ID, which is the 12-digit number in your portal URL.
  • Permission to create a datastream and an ingest token.

​
Network

Confirm both paths before configuring anything:
The HSM is the sender, so the collector must be reachable from the HSM. A collector behind NAT, on a laptop VPN, or on a host that only listens on loopback will silently receive nothing. UDP gives you no error when delivery fails.

​
Clock

The HSM stamps its log messages in UTC, and the syslog header carries no timezone. Synchronize both the HSM and the collector host to NTP. If the clocks drift apart, events arrive in Observe with timestamps that do not match reality, and correlation against other data sources breaks.

​
Transport limitations

Be aware of the following before you commit to this design:
  • Forwarding is UDP only. This firmware offers no TCP or TLS syslog transport for HSM device logs.
  • There is no authentication on the syslog stream. Any host that can reach the listener can inject messages that look like HSM events.
  • Delivery is best effort. A dropped datagram is lost with no retransmission and no gap indicator.
If your security policy forbids cleartext, unauthenticated log transport, use VIP syslog export over TCP with TLS instead, and accept that its content differs. See Syslog server configuration for VirtuCrypt.

Related topics

Before you start