Integrating JumpServer with Syslog: A Step-by-Step Guide for Enhanced SIEM Security Auditing
Integrating JumpServer with Syslog: A Step-by-Step Guide for Enhanced SIEM Security Auditing
Published on 2026-02-02
16 views
In the realm of enterprise security, centralized log management is crucial for real-time monitoring and compliance. JumpServer, as a premier Privileged Access Management (PAM) solution, supports seamless integration with the Syslog logging system. By configuring JumpServer to push logs to a Syslog server, organizations can easily forward critical security data to SIEM (Security Information and Event Management) systems for advanced threat analysis.
This guide details how to configure a Linux-based Syslog server and connect it with your JumpServer environment.
Prerequisites
Before starting the configuration, ensure you have a server dedicated to receiving Syslog messages.
OS: Linux (e.g., CentOS 7).
Hardware: Recommended specifications are 2 CPU cores, 4GB RAM, and 200GB storage.
Network: Ensure the server's firewall allows traffic on UDP port 514.
Step 1: Configure the Syslog Server
To prepare the destination server to receive logs from JumpServer, you must modify the rsyslog configuration.
Edit the Configuration File: Open the /etc/rsyslog.conf file on your Syslog server.
Enable UDP Reception: Locate and uncomment the following lines to allow log input via UDP on port 514.
Define Log Output Location: Add the following rule to direct the logs to a specific file (e.g., /tmp/messages) using the local2 facility.
Restart the Service: Apply the changes by restarting the Syslog service.
Test Connectivity: You can verify the configuration by sending a test message from the JumpServer host to the Syslog server (replace 10.1.12.116 with your Syslog server IP).
Check the output file on the Syslog server to confirm the message was received.
Step 2: Configure JumpServer
Once the Syslog server is ready, configure JumpServer to start sending logs.
Modify the Config File: Locate the JumpServer configuration file, typically found at /opt/jumpserver/config/config.txt.
Add Syslog Parameters: Append or modify the following settings to enable Syslog, define the target address, and set the facility.
# Configure syslog
SYSLOG_ENABLE=true
SYSLOG_ADDR=10.1.12.116:514 # The IP address and port of the Syslog server
SYSLOG_FACILITY=local2 #Based on the Syslog configuration file
Apply Changes: Restart JumpServer to load the new configuration.
jmsctl restart
Step 3: Verify and Analyze Logs
After restarting, perform operations within JumpServer (such as logging in) to generate new logs. Check your Syslog server to ensure the data is arriving correctly.
Log Data Structure for SIEM Parsing JumpServer exports logs in a structured format suitable for SIEM parsing. The logs include rich metadata such as IP addresses, user details, and operation types. Supported log categories include:
Login Logs: Records user authentication details, including success status and MFA usage.
File Transfer Logs: Tracks file uploads and downloads with filenames and timestamps.
Operation Logs: Audits system changes, such as modifying organizational settings.
Session Logs: Captures SSH or Web Terminal session details, including command execution flags.
Command Logs: detailed records of commands executed during sessions (e.g., free -h) along with their output.
By forwarding these JSON-structured logs via Syslog, your security team can gain full visibility into privileged activities directly within your SIEM dashboard.
