> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays.md).

# Event Relays

Configuring event relays allows you to use the Enginsight Pulsar agent as a syslog relay. It receives syslog data from sources on which Pulsar cannot be installed, processes the data, and forwards it to Enginsight SIEM.

***

## Important Notes

* Data transfer between the event relay and the API uses GZIP level 9, which results in a data compression ratio of approximately 20:1 to conserve resources.
* If different syslog formats are used in your network, you can configure **multiple event relays on a single Pulsar** for the different syslog formats. However, you must ensure that **each event relay uses a separate port**.

**Matching settings in the log source and event relay**

* The settings in your log source and in the event relay for the syslog format must match. If you cannot make manual adjustments on the log source, use the **RFC 3164** **format** in the event relay.

{% hint style="success" icon="lightbulb" %}
For more information on how to find out the syslog format used by the log source using `tcpdump`, see our Knowledge Base: [No logs are arriving at my Enginsight event relay. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/no-logs-are-arriving-at-my-enginsight-event-relay-what-can-i-do)
{% endhint %}

* The settings in your log source and in the event relay for the port must match. If you cannot make manual adjustments on the log source, use the **default port 514** in the event relay.

**Error in the `rlylog.content` / `rlylog.tag` field**

* If parts of the `rlylog.content` field appear in the `rlylog.tag` field, this can cause extraction errors. In this case, use the **RFC 5424** **format** or **enable a tag** in the source software. This allows the SIEM to clearly identify which field corresponds to the actual log tag, since this cannot always be determined unambiguously.

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Event Relay** to show a list of all configured event relays. If you have not created an event relay yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FxriSnggceyIC5vLPEVMp%2Fenginsight-screenshot-siem-general%20collectors-event%20relays.jpg?alt=media&amp;token=e0eb1984-e8f5-4153-9fae-54c642cd5d54" alt=""><figcaption></figcaption></figure>

The [event relay overview](#event-relays-overview) provides information such as:

* the host on which the Pulsar acting as the event relay is installed.
* the transport protocol and port through which an event relay receives incoming syslog data.
* the syslog format used.
* whether an event relay is active or inactive.

You can also enable and disable event relays, [add new event relays](#add-event-relay), and show collected logs directly in the [data lake](/docs/manual/english/platform-usage/siem/data-lake.md).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="209.06640625">Action</th><th>Description</th></tr></thead><tbody><tr><td>Delete</td><td><p>Delete all selected objects.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Delete</strong> and confirm the prompt that appears by clicking <strong>Delete Irretrievably</strong>.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Deleted items cannot be recovered.</p></div></td></tr><tr><td>Enable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are inactive.<br><br>Enable all inactive objects.</td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are active.<br><br>Disable all active objects.</td></tr></tbody></table>

***

## Event Relays: Overview

The event relay overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FNP8nExqB6rxwS7mJMce4%2Fenginsight-screenshot-siem-general%20collectors-event%20relays%20overview.jpg?alt=media&amp;token=7f550e67-350f-40fa-913e-503281cd0064" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="199.70703125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the event relay and an additional description, if provided.</p><p></p><p>The date and time of creation and last edit are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an event relay to navigate to the respective <a href="#event-relays-edit-view">edit view</a>. Here you can adjust configured settings and delete the event relay.</p></td></tr><tr><td>Host</td><td><p>Shows the name of the host on which the Pulsar acting as the event relay is installed.</p><p><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a host to navigate to the respective <a href="/docs/manual/english/platform-usage/host-detail-view.md">host detail view</a>.</p></td></tr><tr><td>Protocol</td><td>Shows the transport protocol through which the event relay receives incoming syslog data.</td></tr><tr><td>Bind Address</td><td>Shows the bind IP address to which the event relay is bound to accept incoming connection requests.</td></tr><tr><td>Port</td><td>Shows the custom port through which the event relay receives incoming syslog data.</td></tr><tr><td>Format</td><td>Shows the custom syslog format used.</td></tr><tr><td>Enabled</td><td>Shows whether the event relay is actively receiving syslog data and forwarding it to the SIEM.<br><br>An enabled event relay is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled event relays are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr><tr><td>Open in Data Lake</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Open in Data Lake</strong> to open the <a href="/docs/manual/english/platform-usage/siem/data-lake.md">data lake</a> in a prefiltered view that shows all log entries forwarded to the SIEM by the event relay.</td></tr></tbody></table>

***

## Adding an Event Relay

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Collector Relay** in the upper-right corner to [create a new event relay](/docs/manual/english/platform-usage/siem/general-collectors/event-relays/add-event-relay.md).

***

## Event Relay: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an event relay to navigate to the respective edit view. Here you can adjust [configured settings](/docs/manual/english/platform-usage/siem/general-collectors/event-relays/add-event-relay.md#general-settings) and delete the event relay.

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list overview.</td></tr><tr><td>Remove</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Remove</strong>, then confirm the prompt that appears to delete the object that you are editing.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Deleted objects cannot be recovered.</p></div></td></tr></tbody></table>

***

## Further Resources

**Knowledge Base**

* [No logs are arriving at my Enginsight event relay. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/no-logs-are-arriving-at-my-enginsight-event-relay-what-can-i-do)

***