Skip to main content
The SLFW command enables syslog forwarding and sets the destination address and port. It is the only command needed. This firmware requires no separate syslog enablement step and no restart. For the full token reference, see SLFW: Enable or disable syslog forwarding.

​
Requirements

Both logins and the SLFW command must travel over the same connection. Authorization is tracked per connection, so if you log in, disconnect, then reconnect to send SLFW, the command is rejected.

​
Record the current setting first

Send SLFW with FS2 to display the configuration without changing it. Capture this output so you can restore the original state later.
Read the response as follows:

​
Enable forwarding

Perform the following steps on one connection to the management port. Substitute your collector’s address and port.
1
Connect to the HSM management port over TLS.
2
Log in as the first administrative identity.
CNY confirms the login succeeded. UL1;UT2;UR1 means one of two required logins is complete, and LCN means the connection is not yet fully authorized.
3
Log in as the second administrative identity.
UL2;UT2;UR0 means the quorum is satisfied, and LCY confirms the connection is now fully authorized.
4
Enable forwarding to the collector.
The response echoes the address and port you set. RR1 confirms no restart is needed, and forwarding begins immediately.
5
Read the setting back to confirm it persisted.
A fully qualified domain name is also accepted in BJ:
A failed login returns a command-specific envelope rather than the standard error shape: [AOGUSR;BBLOGIN FAILED;CNN;ERInvalid login.;]. The MI token counts missed attempts, and TO reports any brute-force lockout in seconds.

​
The change is audited to the previous destination

Changing the forwarding target generates its own audit event, and that event is delivered to the old destination, not the new one. After changing the port from 5516 to 5515, the previous collector receives:
This is expected. It also means the first evidence of a redirection appears in the old log destination, which is useful when auditing who moved a log stream. Both administrators who authorized the change are named in the event.

​
Disable forwarding

Send these commands on the same dual-admin connection to the management port that you used to enable forwarding. To stop forwarding, send FS0. Forwarding stops immediately, but the HSM keeps the destination address and port:
While forwarding is disabled, the HSM ignores BJ and BO. A request such as [AOSLFW;FS0;BJ0.0.0.0;BO514;] is accepted but leaves the stored destination unchanged, so a later FS2 still shows the old collector.

​
Restore the original configuration

To restore the configuration you recorded in Record the current setting first, set the recorded address and port with FS1. If forwarding was originally disabled, send FS0 afterward. This example restores the factory default, which is disabled with no destination:
1
Set the recorded address and port.
BJ0.0.0.0 is not a reachable destination, so no messages are delivered while forwarding is briefly on.
2
Disable forwarding.
3
Read the setting back and compare it with the output you recorded before you began.
If forwarding was already enabled before you began, send FS1 with the address and port you recorded and skip the FS0 step.