Skip to main content
The SLFW command enables syslog forwarding and sets the destination address and port. It is the only command needed. This firmware requires no separate syslog enablement step and no restart. For the full token reference, see SLFW: Enable or disable syslog forwarding.

​
Requirements

Both logins and the SLFW command must travel over the same connection. Authorization is tracked per connection, so if you log in, disconnect, then reconnect to send SLFW, the command is rejected.

​
Record the current setting first

Send SLFW with FS2 to display the configuration without changing it. Capture this output so you can restore the original state later.
Read the response as follows:

​
Enable forwarding

Perform the following steps on one connection to the management port. Substitute your collector’s address and port.
1
Connect to the HSM management port over TLS.
2
Log in as the first administrative identity.
CNY confirms the login succeeded. UL1;UT2;UR1 means one of two required logins is complete, and LCN means the connection is not yet fully authorized.
3
Log in as the second administrative identity.
UL2;UT2;UR0 means the quorum is satisfied, and LCY confirms the connection is now fully authorized.
4
Enable forwarding to the collector.
The response echoes the address and port you set. RR1 confirms no restart is needed, and forwarding begins immediately.
5
Read the setting back to confirm it persisted.
A fully qualified domain name is also accepted in BJ:
A failed login returns a command-specific envelope rather than the standard error shape: [AOGUSR;BBLOGIN FAILED;CNN;ERInvalid login.;]. The MI token counts missed attempts, and TO reports any brute-force lockout in seconds.

​
The change is audited to the previous destination

Changing the forwarding target generates its own audit event, and that event is delivered to the old destination, not the new one. After changing the port from 5516 to 5515, the previous collector receives:
This is expected. It also means the first evidence of a redirection appears in the old log destination, which is useful when auditing who moved a log stream. Both administrators who authorized the change are named in the event.

​
Disable forwarding

To stop forwarding, send FS0. The address and port reset to their defaults in the response:
To restore a previous configuration, send FS1 again with the address and port you recorded earlier.

Related topics

Log ingestion with ObserveDeploy the OpenTelemetry CollectorAppendix A: Futurex syslog message formatBefore you startValidate the integration