# SIEM configuration

**URL:** <https://vaultwarden.discourse.group/t/siem-configuration/3952>\
**Category:** Help\
**Created:** [September 4, 2024, 3:28am UTC](https://vaultwarden.discourse.group/t/siem-configuration/3952 "2024-09-04T03:28:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alfredos](https://avatars.discourse-cdn.com/v4/letter/a/ed8c4c/32.png) [@alfredos](https://vaultwarden.discourse.group/u/alfredos)\
**Post date:** [September 4, 2024, 3:28am UTC](https://vaultwarden.discourse.group/t/siem-configuration/3952/1 "2024-09-04T03:28:19Z")

</div>

Hello community,

I’m having an hard time trying to configure syslog events forwarding. I’ve already enabled it from the .yml file but still can’t find a way to configure it to send the logs directly to my SIEM (I’ve already tried to forward the file via rsyslog, it is not the solution I’m looking for).

Thanks in advance for the help or suggestions

---

<div class="post-metadata">

**Author:** ![nicoive](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/nicoive/32/1645_2.png) [@nicoive](https://vaultwarden.discourse.group/u/nicoive)\
**Post date:** [February 8, 2025, 10:50am UTC](https://vaultwarden.discourse.group/t/siem-configuration/3952/2 "2025-02-08T10:50:18Z")

</div>

can someone explain how to point the logs to syslog server?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [February 8, 2025, 12:21pm UTC](https://vaultwarden.discourse.group/t/siem-configuration/3952/3 "2025-02-08T12:21:11Z")

</div>

See

> <https://github.com/dani-garcia/vaultwarden/blob/1f868b8d22ce15c892d8b3ef5a958a045a4fdae9/.env.template#L369-L371>

There is no support for an external server though. But you can configure that on the host it self i think.