How to mirror the WordPress activity log to a syslog server or file

Syslog is a messaging standard. It is used as a logging mechanism and also to centralize the logs of a number of computers, servers, services, and other devices to a central location.

If you use Syslog to centralize all the logs of your business, you can use the WP Activity Log plugin to mirror the WordPress activity log to the web server’s local syslog, or to a remote Syslog server. The WordPress activity log is mirrored in real-time, so you can see what is happening on your site in real-time, directly from syslog and without the need to log in to each individual website.

This document explains how you can mirror the activity log of your websites to Syslog. The process consists of two steps:

1. Setting up a Syslog connection in the plugin
2. Configuring the mirroring of the activity logs to Syslog

1. Setting up a syslog connection

To setup a syslog connection in the plugin:

1. Click on the Integrations node in the plugin menu.
2. Click the Create a Connection button to launch the connection setup wizard.
3. Select Syslog from the Type of Connection drop-down menu in the first step of the wizard and click Next.
4. When the plugin completes the requirements test, click Next.

5. In the second step of the wizard, specify if you want to mirror the activity logs to:
   • The web server’s Syslog by selecting Write to local syslog file
   • A remote Syslog server by selecting Send messages to remote syslog server

• If you select to send the messages to a remote Syslog server, first choose whether you want to connect over TCP or UDP by checking the appropriate checkbox. Next, enter the IP address and port of the remote Syslog server in the respective placeholders. Check the Enable to use SSL/TLS to connect checkbox.

5. Click Next to run a connectivity test, and click Next again once the test is successful.
6. In the last step of the wizard, specify a name for the connection. Connection names are just a reference for you and can be up to 25 characters long and can only consist of letters, numbers, and underscores.

Testing the Syslog connection

Once the connection is set up it will be listed in the Connections tab. Click the Send a test message button to send a test message to the Syslog server via the plugin and confirm the configuration.

Configuring the mirroring to Syslog

Once the Syslog connection is set up, you have to configure the plugin to mirror the logs to the newly configured connection by following the below instructions:

1. Click on Integrations in the plugin menu.
2. Navigate to the Mirroring tab and click the Setup an Activity Log Mirror button.

3. In the first step of the wizard, specify the following:
   • Friendly name for the mirror.
   • Mirror identifier in logs (this will be added to each event, so you know the source of the activity log event).
   • Select the Syslog connection you’ve just set up from the Connection drop-down menu.
4. In the second step of the wizard, specify if you want the mirroring to start right away.

5. In the last step of the wizard, you can configure activity log filtering rules for the mirroring connection. By default, the connection is set to Send all events option, though if you’d like to set up any filtering rules, refer to configuring filtering rules for activity log mirroring connections.
6. Click Save Mirror to save the new mirroring process.

WordPress activity log in your Syslog

That is it. Now the plugin will send a copy of the activity log events to your syslog file or Syslog server as they happen, in real-time!

Restrict log writing to mirror only

Once the mirroring setup process is complete, and WP Activity Log has successfully started writing to Syslog, you will have the option to stop writing activity logs to the database. While this will help you prevent redundant data, do keep in mind that the plugin will only write activity logs to the configured mirror(s).

To stop writing activity logs to the database, switch off the Write activity log to database option as available in the Mirroring tab.

More information & other integrations

Refer to getting started with mirroring the WordPress activity log for more information on the format of the logs, the third-party services the plugin can mirror activity logs to, and other technical details.