Skip to main content
This guide shows how to forward HSM audit logs into Observe, an observability and SIEM platform. You enable syslog forwarding on the HSM, run an OpenTelemetry Collector to receive and parse the messages, and ship them to an Observe datastream over OTLP. Observe consumes telemetry. It does not perform cryptographic operations and it does not act as a key consumer, so this integration is a log and telemetry exercise. It does not use PKCS #11, KMIP, or CNG.

​
Architecture

The HSM sends syslog over UDP. Observe accepts OTLP over HTTPS. The collector bridges the two, and it is also where the messages get parsed into usable fields.

​
Choose the right log source

Futurex offers two separate ways to export logs, and they carry different content. Read this table before you build anything. For VIP syslog export, see Syslog server configuration for VirtuCrypt.
The two sources are complementary, not alternatives. If you need a complete audit picture in Observe, send both. Each needs its own collector receiver or datastream, because the message formats differ.

​
What this guide covers

This guide was validated end to end against an Excrypt HSM running firmware 7.10.1.4, with OpenTelemetry Collector Contrib v0.159.0.
HSM syslog forwarding uses UDP with no TLS and no authentication on this firmware. Messages cross the network in cleartext and delivery is not guaranteed. Keep the collector on a trusted network segment close to the HSM, and restrict which hosts may reach the listener. Do not forward HSM syslog across an untrusted network.
The forwarded messages contain identity names, configuration changes, and login outcomes. They do not contain key material, PINs, or cryptographic payloads.
This guide includes the following topics:

Related topics

Appendix B: TroubleshootingVirtuCrypt integration guides overviewCreate an Observe datastream and tokenBefore you startValidate the integration