> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/settings/audit-logs.md).

# Audit Logs

The Log Configuration page allows you to define how FSProtect records, stores, and forwards log data generated by the platform.\
Depending on your setup, logs can be saved locally, sent to a Syslog server, or disabled entirely.

<figure><img src="/files/pG5UzN0TSsRz9ZVtJr3u" alt="Log Configuration Main Screen"><figcaption><p><em>Log Configuration Main Screen</em></p></figcaption></figure>

### Configuring Log Storage and Forwarding

You can configure how FSProtect handles log output using the parameters described below.

#### **Status**

Defines the behavior of the logging system.\
Options include: **Disabled**, **Save to File**, **Send to Syslog**, and **Save to File and Send to Syslog**.

<figure><img src="/files/ITvi8K0wbDLqjugmYIiI" alt=""><figcaption><p>Status options</p></figcaption></figure>

***

### Save to File Mode

When **Save to File** is selected, FSProtect writes logs to a local file on the server.

<figure><img src="/files/0u3Tu805kcEda27Xh1hh" alt=""><figcaption><p><em>Save to File Configuration</em></p></figcaption></figure>

#### **File Path**

The full path where the log file will be created

```
C:\Forestall\FSProtect\django\logs\request.log
```

FSProtect automatically creates the file and its directory if they do not already exist.

### Send to Syslog Mode

When **Send to Syslog** is selected, FSProtect forwards all logs to an external Syslog/SIEM server.

<figure><img src="/files/7yW1dQqfr5dRmF1Ls6jW" alt=""><figcaption><p><em>Send to Syslog Configuration</em></p></figcaption></figure>

#### **Log Server Hostname/IP**

The address of the Syslog server that will receive log messages.

#### **Port**

The Syslog port number. Common default: `514`.

#### **Protocol**

The communication protocol for sending logs. Options: **UDP** or **TCP**. In this mode, no logs are stored locally.

***

### Save to File and Send to Syslog Mode

This mode enables both local storage and external forwarding simultaneously.

<figure><img src="/files/S56sdnjcN0ffzLLmux6V" alt=""><figcaption><p><em>Save to File and Send to Syslog Configuration</em></p></figcaption></figure>

#### **Behavior**

* FSProtect writes logs to the specified file path
* The same log entries are forwarded to the Syslog server
* Redundant logging ensures no data loss if the Syslog server becomes temporarily unreachable

#### **Fields**

* File Path
* Syslog Hostname/IP
* Port
* Protocol