Centralized Event Logging Support Estimated Reading Time: 3 Minutes Ubersmith can send its event log entries to syslog. You can then forward these entries to a central logging system. This capability helps you meet PCI-DSS requirements and security requirements. It uses the default installation directory, /usr/local/ubersmith. If Ubersmith is installed in a different directory, use that directory instead. How it works In a standard installation, event logging to syslog is on by default. You do not need to change the configuration. The rsyslog container starts with the other core containers. It creates a log socket at /usr/local/ubersmith/logs/rsyslog/log. The php container mounts this socket as /dev/log. The php container starts only after the rsyslog container is healthy. Ubersmith sends each entry to the socket with the syslog facility local7 and the program name ubersmith. The rsyslog container sends the entries to the systemd journal on the host, with the tag ubersmith/ubersmith. For more information about the containers, refer to the article "Ubersmith and Docker". What Ubersmith logs Ubersmith sends one syslog entry for each of these events: Event log entries, for example changes to clients, services, and settings Login events for staff, clients, and contacts Device events Support ticket events Integration log messages, for example from domain registrar, import, and payment modules. Ubersmith sends these messages only at the log level that is set for each integration. Each entry is a JSON object. It has fields such as type, event_id, event_type, user, and ip_addr. Other fields depend on the type of event, for example client_id, device_id, or ticket_id. View the entries On the host, run this command: journalctl -f -t ubersmith/ubersmith The -f option shows new entries as they arrive. To stop, press Ctrl+C. The installer sets the journal to keep entries for one year (MaxRetentionSec=1year in /etc/systemd/journald.conf). Forward the entries to a central logging system Configure the systemd journal on the host to forward entries to your central logging system. For the configuration, refer to the systemd documentation for these services: systemd-journal-upload, which sends journal entries to a remote server systemd-journal-remote, which receives journal entries on the central server To forward only the Ubersmith event entries, filter on the tag ubersmith/ubersmith. Troubleshooting If no entries show in the journal, do these checks: Make sure that the rsyslog container is running: cd /usr/local/ubersmith docker compose -p ubersmith ps rsyslog Make sure that /usr/local/ubersmith/logs/rsyslog/log is a socket: file /usr/local/ubersmith/logs/rsyslog/log The output must be log: socket. If log is a directory, or if it is missing, recreate the socket: These commands stop the php container for a short time. Ubersmith cannot process requests until the php container starts again. Stop and remove the php and rsyslog containers: cd /usr/local/ubersmith docker compose -p ubersmith rm -sf php rsyslog Remove the old contents of /usr/local/ubersmith/logs/rsyslog/. Start the rsyslog container, then the php container: docker compose -p ubersmith up -d rsyslog docker compose -p ubersmith up -d php The rsyslog container creates a new socket. The php container then mounts it.