Syslog Collector

Related Resources

Virtual Machines

Virtual Networks

Network Security Groups

Managed Disks

Overview

The syslog collector is a dedicated Linux VM used to receive Pexip Infinity syslog traffic from the MaxConf test and production environments. It is provisioned by the verify-by-video-iac repository and is separate from the Pexip appliance VMs.

The collector uses a dedicated VNet and private VNet peering to vn-maxconf-core. Pexip sends logs to the collector private IP over TCP/514.

Current Azure Resources

Resource	Name	Purpose
Resource group	rg-pexip-syslogs-prod	Owns the syslog collector workload
VNet	vnet-pexip-syslogs-prod	Dedicated collector network
Subnet	snet-pexip-syslogs-prod	Collector VM subnet
NSG	nsg-pexip-syslogs-prod	Allows syslog and restricted admin access
VM	vm-pexip-syslogs-prod	Ubuntu syslog collector
NIC	nic-pexip-syslogs-prod	Static private IP for syslog target
Private IP	10.20.0.10	Pexip syslog destination
Public IP	20.220.217.96	Restricted admin SSH while no private admin path exists
OS disk	dsk-pexip-syslogs-prod-os	Collector VM OS disk
Log disk	dsk-pexip-syslogs-prod-logs	Mounted at /var/log/remote for received logs
Recovery vault	rsv-pexip-syslogs-prod	Azure Backup protection

Network Flow

Pexip systems send syslog to the collector private IP over VNet peering:

vn-maxconf-core/sn-maxconf-prod  10.200.48.0/24 --> 10.20.0.10:514 TCP
vn-maxconf-core/sn-maxconf-test  10.200.49.0/24 --> 10.20.0.10:514 TCP

Both VNet peerings must be connected:

vnet-pexip-syslogs-prod -> vn-maxconf-core
vn-maxconf-core -> vnet-pexip-syslogs-prod

The verified peering state is Connected and FullyInSync on both sides.

Security Rules

The collector NSG is attached to snet-pexip-syslogs-prod.

Inbound rules:

Rule	Source	Destination	Purpose
allow-syslog-tcp	10.200.48.0/24, 10.200.49.0/24	TCP/514	Pexip syslog ingestion
allow-ssh-admin	Approved admin /32 CIDR	TCP/22	Restricted SSH administration
deny-all-inbound	*	*	Deny all other inbound traffic

The public IP is only for restricted administration. Syslog ingestion must use the private IP 10.20.0.10.

Outbound rules are restricted by an explicit deny-all rule with allow rules for Azure platform services, DNS, Azure Monitor, VNet traffic, and bootstrap package installation. The bootstrap internet rule can be tightened later if a stricter steady-state policy is required.

Collector Configuration

The VM is bootstrapped by an Azure Custom Script extension. The script:

• installs rsyslog
• mounts the log data disk at /var/log/remote
• listens for TCP syslog on port 514
• writes logs into environment-specific folders based on source IP

The current routing logic is:

Source	Path
10.200.48.0/24	/var/log/remote/prod/<hostname>/YYYY-MM-DD.log
10.200.49.0/24	/var/log/remote/test/<hostname>/YYYY-MM-DD.log
local collector logs	/var/log/remote/collector/<hostname>/YYYY-MM-DD.log
unexpected source IPs	/var/log/remote/unknown/<source-ip>/<hostname>/YYYY-MM-DD.log

Example verified paths:

/var/log/remote/test/conference/2026-06-22.log
/var/log/remote/prod/conference/2026-06-22.log
/var/log/remote/collector/vm-pexip-syslogs-prod/2026-06-22.log

Older files may exist directly under /var/log/remote/<hostname>/ from before environment-based routing was enabled. New logs should use the test, prod, collector, or unknown folders.

Pexip Configuration

Create or update the syslog server in the Pexip Infinity management portal:

System > Syslog servers

Use:

Address: 10.20.0.10
Port: 514
Transport: TCP
Support log: enabled
Audit log: enabled
Web server log: enabled

TCP is preferred for this deployment because it is easier to test and provides connection-level delivery behavior. The collector is configured for TCP syslog on port 514.

Pexip can send to more than one syslog server at the same time. During migration, keep the old syslog server selected and add the new collector in parallel:

Old syslog: 10.200.52.4:514 TCP
New syslog: 10.20.0.10:514 TCP

Creating the syslog server entry does not automatically enable log shipping from all nodes. Assign the syslog server in the appropriate Pexip locations:

• Management Node logs: assign the new syslog server to the Management Node.
• Conferencing Node logs: assign the new syslog server to the System Location associated with the conferencing node:

Platform > Locations > <location name> > Syslog servers > Chosen Syslog servers

Move the new collector, 10.20.0.10, from Available Syslog servers to Chosen Syslog servers. During migration, keep the old collector, 10.200.52.4, in Chosen Syslog servers as well so Pexip sends to both destinations while validation is in progress.

For test, use the test Pexip management portal and the test system location. For production, use the production Pexip management portal and the production system location.

Validation

Confirm the collector is healthy:

systemctl status rsyslog --no-pager
ss -ltnp | grep ':514'
mountpoint /var/log/remote
df -h /var/log/remote

Expected results:

• rsyslog is active
• TCP/514 is listening
• /var/log/remote is a mountpoint
• the data disk has available capacity

Confirm network connectivity from a Pexip node or a host in the Pexip subnet:

nc -vz 10.20.0.10 514

Expected result:

Connection to 10.20.0.10 514 port [tcp/*] succeeded

Watch incoming logs:

sudo tail -f /var/log/remote/test/*/*.log
sudo tail -f /var/log/remote/prod/*/*.log

List recent log files:

sudo find /var/log/remote -maxdepth 4 -type f -mmin -20 -ls

Check active TCP connections to the collector:

sudo ss -tn state established '( sport = :514 )'

Verified examples:

10.200.49.5 -> 10.20.0.10:514  test conference node
10.200.48.4 -> 10.20.0.10:514  prod conference node

Operational Notes

• Do not remove the old syslog server until both test and production logs are verified on the new collector.
• Keep the old and new syslog servers configured in parallel during validation.
• Existing log files are not moved when routing changes. Only new logs follow the current routing rules.
• If no logs arrive, confirm the Pexip syslog server uses TCP, not UDP.
• If conferencing node logs do not arrive, confirm the syslog server is assigned to the correct Pexip System Location or region.
• If management node logs do not arrive, confirm the syslog server is assigned to the Management Node.
• Unexpected sources are intentionally written to /var/log/remote/unknown/ so they can be investigated without dropping logs.