# Audit Logs

The Log Configuration page allows you to define how FSProtect records, stores, and forwards log data generated by the platform.\
Depending on your setup, logs can be saved locally, sent to a Syslog server, or disabled entirely.

<figure><img src="/files/pG5UzN0TSsRz9ZVtJr3u" alt="Log Configuration Main Screen"><figcaption><p><em>Log Configuration Main Screen</em></p></figcaption></figure>

### Configuring Log Storage and Forwarding

You can configure how FSProtect handles log output using the parameters described below.

#### **Status**

Defines the behavior of the logging system.\
Options include: **Disabled**, **Save to File**, **Send to Syslog**, and **Save to File and Send to Syslog**.

<figure><img src="/files/ITvi8K0wbDLqjugmYIiI" alt=""><figcaption><p>Status options</p></figcaption></figure>

***

### Save to File Mode

When **Save to File** is selected, FSProtect writes logs to a local file on the server.&#x20;

<figure><img src="/files/0u3Tu805kcEda27Xh1hh" alt=""><figcaption><p><em>Save to File Configuration</em></p></figcaption></figure>

#### **File Path**

The full path where the log file will be created

```
C:\Forestall\FSProtect\django\logs\request.log
```

FSProtect automatically creates the file and its directory if they do not already exist.

### Send to Syslog Mode

When **Send to Syslog** is selected, FSProtect forwards all logs to an external Syslog/SIEM server.

<figure><img src="/files/7yW1dQqfr5dRmF1Ls6jW" alt=""><figcaption><p><em>Send to Syslog Configuration</em></p></figcaption></figure>

#### **Log Server Hostname/IP**

The address of the Syslog server that will receive log messages.

#### **Port**

The Syslog port number. Common default: `514`.

#### **Protocol**

The communication protocol for sending logs. Options: **UDP** or **TCP**. In this mode, no logs are stored locally.

***

### Save to File and Send to Syslog Mode

This mode enables both local storage and external forwarding simultaneously.

<figure><img src="/files/S56sdnjcN0ffzLLmux6V" alt=""><figcaption><p><em>Save to File and Send to Syslog Configuration</em></p></figcaption></figure>

#### **Behavior**

* FSProtect writes logs to the specified file path
* The same log entries are forwarded to the Syslog server
* Redundant logging ensures no data loss if the Syslog server becomes temporarily unreachable

#### **Fields**

* File Path
* Syslog Hostname/IP
* Port
* Protocol


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/settings/audit-logs.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
