Overview:
The Guardz Log Collector lets you receive syslog messages from your firewalls and store them in Guardz alongside your existing security detections. This gives MSPs a single place for both Guardz-generated findings and raw firewall audit logs—without requiring customers to run their own log management infrastructure.
Pre-requisites
Make sure the following are in place before you start:
The Guardz Agent is installed on a Windows device at the customer site.
That device is always on — if the machine collecting logs is powered off or asleep, logs will be lost and the configuration is not considered compliant.
The device is reachable from the firewall on the local network (or wherever the firewall will direct its syslog traffic).
The customer's Guardz account has the Sys Log add-on enabled (see Licensing below).
Please note:
Syslog collection requires a Windows device. The Guardz Agent on macOS does not
run the log collector.
Licensing and Subscription Aspects:
Syslog collection is a paid add-on available on top of any Guardz plan. It is billed based on storage consumption at a flat rate per gigabyte. Contact your Guardz account manager to enable the add-on for a customer account.
How does it work?
The Guardz Agent embeds a lightweight log collector (based on Fluent Bit, running as a Windows service called guardz-collector). When Firewall Sys Logs is enabled for a device in the Log Viewer, the agent:
Starts the collector service on that Windows device.
Opens inbound Windows Firewall rules so the device can receive syslog traffic on the standard ports
Forwards received log messages to Guardz for storage and viewing in the Log Viewer.
Your firewall should be configured to send its syslog output to the IP address of the Windows device running the agent. No additional software is needed on the device.
Enabling the Service
Step 1: Enable log collection in Guardz
In the Guardz console, go to Log Viewer.
The Log Viewer lists all Guardz Agents installed across the customer's environment.
Find the Windows device you want to use as the syslog receiver.
Enable the Firewall Sys Logs toggle for that device.
You can also enable the Windows Event Logs toggle on the same device to collect Windows system events alongside firewall logs.
The agent checks for updated configuration approximately every 5 minutes, so the change takes effect within a few minutes — no reinstall or reboot is required. Once applied, the collector service starts and the required inbound Windows Firewall rules are created automatically (one rule per listener, across all network profiles).
Step 2: Choose and prepare the collecting device
Use a Windows device with the Guardz Agent installed that is always on and reachable from the firewall.
Assign the device a static IP address, or a DHCP reservation. The firewall will be configured to send logs to this address, so an address that can change later will break log delivery.
Step 3: Configure your firewall to send syslogs
In your firewall's management interface, navigate to the syslog or logging settings.
Add a new syslog server destination using the IP address of the Windows device from Step 2.
Choose the port and protocol that match your firewall's syslog format (see Supported ports and formats below — if in doubt, start with UDP 514).
Select which log types or severities to send (e.g., traffic, threat, and system events).
Save and apply the configuration.
Detailed, vendor-specific configuration steps for common firewall products will be added here. If you need guidance for a specific firewall, contact Guardz Support.
Step 4: Confirm the network path
The firewall must be able to reach the collecting device on the chosen port. If there are VLANs, ACLs, or other firewalls between them, allow syslog traffic (514/1514) through to the device.
Separately, the collecting device needs outbound HTTPS (TCP 443) internet access, since the collector forwards logs to Guardz over an encrypted connection. Confirm this isn't blocked by local network policy.
Step 5: Verify the collector is running
Generate some log activity on the firewall, then confirm the logs appear in the Guardz Log Viewer.
On the collecting device, you can also confirm the collector service is healthy by running the following in an elevated PowerShell session (Run as Administrator):
powershell
# The collector service should be Running Get-Service 'Guardz Log Collector' # The listeners should be owned by the guardz-collector process Get-NetTCPConnection -LocalPort 514,1514 -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess, @{ n = 'Process'; e = { (Get-Process -Id $_.OwningProcess).ProcessName } } Get-NetUDPEndpoint | Where-Object { $_.LocalPort -in 514, 1514 } | Select-Object LocalAddress, LocalPort, OwningProcess, @{ n = 'Process'; e = { (Get-Process -Id $_.OwningProcess).ProcessName } }
Supported ports and formats
The Guardz Log Collector listens on four port/format/transport combinations to accommodate both modern and legacy firewall equipment. The device's inbound Windows Firewall rules are configured automatically to match.
Format | Transport | Port | Typical use |
RFC 5424 (structured) | TCP | 514 | Modern firewalls — standard syslog over TCP |
RFC 3164 (BSD legacy) | UDP | 514 | Legacy firewalls — zero-config default |
RFC 3164 (BSD legacy) | TCP | 1514 | Legacy firewalls preferring TCP |
RFC 5424 (structured) | UDP | 1514 | Modern firewalls preferring UDP |
If you are unsure which format your firewall uses, UDP 514 is the most widely supported default.
Viewing the Collected Logs
Once the firewall is sending logs and the agent is receiving them:
In the Guardz console, go to Log Viewer section.
Switch to the Logs tab.
You will see all log types Guardz is currently collecting for that customer — firewall syslogs, Windows Event Logs (if enabled), and any other sources.
Troubleshooting
Issue: Logs are not appearing in the Log Viewer.
Resolution:
Confirm the Firewall Sys Logs toggle is enabled for the correct device in the Log Viewer.
Verify the firewall is configured to send to the correct IP address and port.
Make sure the Windows device running the agent is powered on and online.
Check that no external or network-level firewall is blocking traffic
Issue: The device I want to use as the collector is not listed.
Resolution: Make sure the Guardz Agent is installed and running on that Windows device. The Log Viewer only lists devices with an active agent.
Issue: The toggle is grayed out or not visible.
Resolution: Syslog collection requires the Sys Log add-on. Contact your Guardz account manager if the option is not available.