> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable HSM syslog forwarding

> Steps to enable syslog forwarding on the HSM with the SLFW Excrypt command, including the dual-admin login requirement and how to roll back.

The `SLFW` command enables syslog forwarding and sets the destination address and port. It is the only command needed. This firmware requires no separate syslog enablement step and no restart.

For the full token reference, see [SLFW: Enable or disable syslog forwarding](/HSM_Commands/7.10.1.x/Excrypt_commands/system/admin/slfw-enable-disable-syslog-forwarding).

## Requirements

| Requirement    | Value                         |
| -------------- | ----------------------------- |
| Permission     | `Diagnostics:Syslog Settings` |
| Port           | Management                    |
| Minimum logins | 2                             |

<Warning>
  Both logins and the `SLFW` command must travel over the **same** connection. Authorization is tracked per connection, so if you log in, disconnect, then reconnect to send `SLFW`, the command is rejected.
</Warning>

## Record the current setting first

Send `SLFW` with `FS2` to display the configuration without changing it. Capture this output so you can restore the original state later.

```text theme={null}
Request:  [AOSLFW;FS2;]

Response: [AOSLFW;FS0;BJ0.0.0.0;HO1;BO514;RR1;]
```

Read the response as follows:

| Token       | Meaning in this example                                              |
| ----------- | -------------------------------------------------------------------- |
| `FS0`       | Forwarding is disabled                                               |
| `BJ0.0.0.0` | No destination configured                                            |
| `HO1`       | The device supports a fully qualified domain name as the destination |
| `BO514`     | Destination port is the default, `514`                               |
| `RR1`       | A syslog restart is not required after a change                      |

## Enable forwarding

Perform the following steps on one connection to the management port. Substitute your collector's address and port.

<Steps>
  <Step>
    Connect to the HSM management port over TLS.
  </Step>

  <Step>
    Log in as the first administrative identity.

    ```text theme={null}
    Request:  [AOGUSR;DAAdmin1;CH<password>;]

    Response: [AOGUSR;CNY;...;UL1;UT2;UR1;LBY;LCN;...]
    ```

    <Check>
      `CNY` confirms the login succeeded. `UL1;UT2;UR1` means one of two required logins is complete, and `LCN` means the connection is not yet fully authorized.
    </Check>
  </Step>

  <Step>
    Log in as the second administrative identity.

    ```text theme={null}
    Request:  [AOGUSR;DAAdmin2;CH<password>;]

    Response: [AOGUSR;CNY;...;UL2;UT2;UR0;LBY;LCY;...]
    ```

    <Check>
      `UL2;UT2;UR0` means the quorum is satisfied, and `LCY` confirms the connection is now fully authorized.
    </Check>
  </Step>

  <Step>
    Enable forwarding to the collector.

    ```text theme={null}
    Request:  [AOSLFW;FS1;BJ10.0.0.20;BO5515;]

    Response: [AOSLFW;FS1;BJ10.0.0.20;HO1;BO5515;RR1;]
    ```

    <Check>
      The response echoes the address and port you set. `RR1` confirms no restart is needed, and forwarding begins immediately.
    </Check>
  </Step>

  <Step>
    Read the setting back to confirm it persisted.

    ```text theme={null}
    Request:  [AOSLFW;FS2;]

    Response: [AOSLFW;FS1;BJ10.0.0.20;HO1;BO5515;RR1;]
    ```
  </Step>
</Steps>

A fully qualified domain name is also accepted in `BJ`:

```text theme={null}
Request:  [AOSLFW;FS1;BJcollector.example.com;BO5515;]

Response: [AOSLFW;FS1;BJcollector.example.com;HO1;BO5515;RR1;]
```

<Note>
  A failed login returns a command-specific envelope rather than the standard error shape:
  `[AOGUSR;BBLOGIN FAILED;CNN;ERInvalid login.;]`. The `MI` token counts missed attempts, and `TO` reports any brute-force lockout in seconds.
</Note>

## The change is audited to the previous destination

Changing the forwarding target generates its own audit event, and that event is delivered to the **old** destination, not the new one. After changing the port from `5516` to `5515`, the previous collector receives:

```text theme={null}
CONFIG:Admin1:Admin2:Syslog:Forwarding Port:5516:5515
```

This is expected. It also means the first evidence of a redirection appears in the old log destination, which is useful when auditing who moved a log stream. Both administrators who authorized the change are named in the event.

## Disable forwarding

To stop forwarding, send `FS0`. The address and port reset to their defaults in the response:

```text theme={null}
Request:  [AOSLFW;FS0;]

Response: [AOSLFW;FS0;BJ0.0.0.0;BO514;]
```

To restore a previous configuration, send `FS1` again with the address and port you recorded earlier.


## Related topics

- [Log ingestion with Observe](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Log_ingestion_with_Observe.md)
- [Deploy the OpenTelemetry Collector](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Deploy_the_OpenTelemetry_Collector.md)
- [Appendix A: Futurex syslog message format](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Appendix_A_Futurex_syslog_message_format.md)
- [Before you start](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Before_you_start.md)
- [Validate the integration](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Validate_the_integration.md)