Log Forwarding¶

HPE Morpheus Software supports forwarding logs from managed hosts and VMs to external logging platforms using Syslog forwarding rules. This enables integration with centralized logging solutions and SIEM platforms such as Splunk, Datadog, Graylog, or any syslog-compatible receiver.

How Log Forwarding Works¶

The HPE Morpheus Software Agent on each managed host watches log files (/var/log/*.log by default, plus any custom log folders configured on Library Node Types). When syslog forwarding rules are configured, the Agent forwards matching log entries directly to the configured syslog destination — logs flow from the managed host to the syslog receiver, not through the HPE Morpheus Software appliance.

Configuring Syslog Forwarding Rules¶

1. Navigate to Administration > Settings > Logs

2. Click + Add Rule

3. Configure the forwarding rule:

   Field	Description
   Name	Descriptive name for the rule
   Rule	The syslog forwarding destination and configuration. Uses standard syslog address format.
   Host	Hostname or IP address of the syslog receiver
   Port	Port number on the syslog receiver (common: 514 for UDP, 1514 for TCP, 6514 for TLS)
   Protocol	Transport protocol: UDP, TCP, or TCP+TLS (secure syslog)

4. Click Save

The rule takes effect on the next Agent check-in cycle for all managed hosts.

Supported Transport Protocols¶

Firewall Requirements¶

For log forwarding to function, the following network paths must be open:

What Gets Forwarded¶

By default, syslog forwarding includes all logs that the HPE Morpheus Software Agent collects:

• System logs (/var/log/syslog, /var/log/messages)

• Application logs (any .log file in /var/log/)

• Custom log folders configured on Library Node Types

• HVM hypervisor logs (kernel, libvirt, agent)

Appliance Service Logs¶

Appliance-level service logs (MySQL, RabbitMQ, OpenSearch, Nginx, application logs) are not forwarded by the Agent-based syslog rules. To forward appliance logs, configure syslog forwarding at the OS level using rsyslog or syslog-ng on the appliance host, or use the logback SIEM appender configuration. See Appliance Log Configuration for details.

Integration with SIEM Platforms¶

For SIEM integration (CEF/LEEF format, structured audit events), HPE Morpheus Software supports a logback-based audit appender that can write directly to SIEM databases or syslog endpoints in Common Event Format. This is configured at the appliance level rather than through the UI forwarding rules. See the CEF/SIEM Auditing section in Appliance Log Configuration.

Troubleshooting Log Forwarding¶

Logs not appearing at the destination:

• Verify network connectivity from a managed host to the syslog receiver on the configured port

• Confirm the HPE Morpheus Software Agent is running on the host (systemctl status morpheus-node-agent)

• Check that the forwarding rule protocol matches what the receiver expects (UDP vs TCP vs TLS)

• Verify no firewall is blocking the syslog port between managed hosts and the receiver

Partial logs forwarded:

• Only files matching .log extension in watched directories are forwarded

• Custom application logs require the LOG FOLDER to be configured on the Library Node Type

• Binary log files or files with non-standard extensions are not forwarded