---
path: faq/docker/syslog.mdx
title: Configuring Syslog for Passwork events
slug: syslog
description: >-
  Configuring rsyslog to forward Passwork events to a separate file, to a SIEM,
  or to stdout in a Docker deployment.
keywords:
  - Passwork
  - Docker
  - Syslog
  - rsyslog
  - SIEM
  - activity log
  - logs
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

When the **Write the activity log to syslog or the Windows event log** setting is enabled, events are forwarded to `./log/php/syslog` by default. Other messages received through rsyslog can end up in the same file as well. You can configure logging so that Passwork events are:

1. Written to a **separate file**
2. Sent to a **SIEM**
3. Forwarded to **stdout**

## Forwarding to a separate file

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="shell" label="shell">

```bash
module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   -/server/www/app/logs/passwork_events
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf
```

  </TabItem>
</Tabs>

## Sending to a SIEM

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="shell" label="shell">

```bash
module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   @@<SIEM_IP>:<SIEM_PORT>
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf
```

  </TabItem>
</Tabs>

Replace `<SIEM_IP>` and `<SIEM_PORT>` with the address and port of your SIEM system.

## Forwarding to stdout

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="shell" label="shell">

```bash
module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then {
   -/proc/1/fd/1
   stop
}
*.*     -/server/log/php/syslog
$IncludeConfig /etc/rsyslog.d/*.conf
```

  </TabItem>
</Tabs>