> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Log ingestion with Observe

> Introduces forwarding Futurex HSM audit logs into Observe through an OpenTelemetry Collector.

This guide shows how to forward HSM audit logs into [Observe](https://www.observeinc.com/), an observability and SIEM platform. You enable syslog forwarding on the HSM, run an OpenTelemetry Collector to receive and parse the messages, and ship them to an Observe datastream over OTLP.

Observe consumes telemetry. It does not perform cryptographic operations and it does not act as a key consumer, so this integration is a log and telemetry exercise. It does not use PKCS #11, KMIP, or CNG.

## Architecture

```mermaid theme={null}
flowchart LR
    HSM["Futurex HSM<br/><small>Audit logs</small>"]
    Collector["OpenTelemetry Collector<br/><small>Receive and parse logs</small>"]
    Observe["Observe datastream<br/><small>Datasets, dashboards, and alerts</small>"]

    HSM -->|UDP syslog| Collector
    Collector -->|HTTPS / OTLP| Observe
```

The HSM sends syslog over UDP. Observe accepts OTLP over HTTPS. The collector bridges the two, and it is also where the messages get parsed into usable fields.

## Choose the right log source

Futurex offers two separate ways to export logs, and they carry different content. Read this table before you build anything.

|                          | HSM syslog forwarding (this guide)                                   | VIP syslog export                                                               |
| ------------------------ | -------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| Source                   | The HSM appliance itself                                             | VirtuCrypt Intelligence Portal account                                          |
| Content                  | Device audit events: logins, configuration changes, identity updates | Portal and account audit logs                                                   |
| Transport                | UDP                                                                  | TCP, default port 6514                                                          |
| TLS                      | Not available                                                        | Supported                                                                       |
| Destination reachability | Any address the HSM can route to                                     | Public ingress only; private and reserved ranges are blocked unless whitelisted |
| Configured with          | The `SLFW` Excrypt command                                           | The VIP web portal                                                              |

For VIP syslog export, see [Syslog server configuration for VirtuCrypt](/Integrations/VirtuCrypt/Syslog_server_configuration_for_VirtuCrypt/Syslog_server_configuration_for_VirtuCrypt).

<Note>
  The two sources are complementary, not alternatives. If you need a complete audit picture in Observe, send both. Each needs its own collector receiver or datastream, because the message formats differ.
</Note>

## What this guide covers

This guide was validated end to end against an Excrypt HSM running firmware `7.10.1.4`, with OpenTelemetry Collector Contrib `v0.159.0`.

<Warning>
  HSM syslog forwarding uses UDP with no TLS and no authentication on this firmware. Messages cross the network in cleartext and delivery is not guaranteed. Keep the collector on a trusted network segment close to the HSM, and restrict which hosts may reach the listener. Do not forward HSM syslog across an untrusted network.
</Warning>

<Note>
  The forwarded messages contain identity names, configuration changes, and login outcomes. They do not contain key material, PINs, or cryptographic payloads.
</Note>

<Info>
  This guide includes the following topics:

  * [**Before you start**](./Before_you_start)
  * [**Create an Observe datastream and token**](./Create_an_Observe_datastream_and_token)
  * [**Deploy the OpenTelemetry Collector**](./Deploy_the_OpenTelemetry_Collector)
  * [**Enable HSM syslog forwarding**](./Enable_HSM_syslog_forwarding)
  * [**Validate the integration**](./Validate_the_integration)
  * [**Build datasets, dashboards, and alerts**](./Build_datasets_dashboards_and_alerts)
  * [**Appendix A: Futurex syslog message format**](./Appendix_A_Futurex_syslog_message_format)
  * [**Appendix B: Troubleshooting**](./Appendix_B_Troubleshooting)
</Info>