> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Pre-deployment checklist covering HSM permissions, collector host, network paths, and clock requirements for Observe log ingestion.

Before beginning, ensure your environment conforms to the following specifications:

## HSM

* firmware `7.10.1.x`. This guide was validated on `7.10.1.4`.
* Two administrative identities with their passwords. The `SLFW` command requires **two logins**, so a single administrator cannot complete it alone.
* Both identities must hold the `Diagnostics:Syslog Settings` permission, which grants configuration of log levels and syslog server information.
* Access to the HSM **management port**, reachable over TLS. The `SLFW` command is not accepted on the production port.

<Note>
  Confirm the permission before you begin. Log in and inspect the `PR` token that the `GUSR` response returns. It lists effective permissions as `Category:Right` pairs, so look for `Diagnostics:` followed by `Syslog Settings`.
</Note>

## Collector host

* A Linux host or container runtime that can run [OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib). Validated on `v0.159.0`.
* The Contrib distribution is required. The core distribution does not include the `udplog` receiver.
* A free UDP port for the syslog listener. This guide uses `5515`. Any port from 1 to 65535 works, and a port above 1024 avoids running the collector as root.
* Outbound HTTPS on port 443 to Observe.

## Observe

* An Observe account. A free trial is sufficient for validation.
* Your Observe customer ID, which is the 12-digit number in your portal URL.
* Permission to create a datastream and an ingest token.

## Network

Confirm both paths before configuring anything:

| From      | To                                     | Protocol    | Port                                        |
| --------- | -------------------------------------- | ----------- | ------------------------------------------- |
| HSM       | Collector                              | UDP         | Your chosen syslog port, for example `5515` |
| Collector | `<customer-id>.collect.observeinc.com` | TCP / HTTPS | 443                                         |

<Warning>
  The HSM is the sender, so the collector must be reachable **from** the HSM. A collector behind NAT, on a laptop VPN, or on a host that only listens on loopback will silently receive nothing. UDP gives you no error when delivery fails.
</Warning>

## Clock

The HSM stamps its log messages in **UTC**, and the syslog header carries no timezone. Synchronize both the HSM and the collector host to NTP. If the clocks drift apart, events arrive in Observe with timestamps that do not match reality, and correlation against other data sources breaks.

## Transport limitations

Be aware of the following before you commit to this design:

* Forwarding is **UDP only**. This firmware offers no TCP or TLS syslog transport for HSM device logs.
* There is no authentication on the syslog stream. Any host that can reach the listener can inject messages that look like HSM events.
* Delivery is best effort. A dropped datagram is lost with no retransmission and no gap indicator.

If your security policy forbids cleartext, unauthenticated log transport, use VIP syslog export over TCP with TLS instead, and accept that its content differs. See [Syslog server configuration for VirtuCrypt](/Integrations/VirtuCrypt/Syslog_server_configuration_for_VirtuCrypt/Syslog_server_configuration_for_VirtuCrypt).


## Related topics

- [Before you start](/Integrations/HSM/IT_automation_and_orchestration/Ansible/Before_you_start.md)