---
sourceDocument: Xanadu ServiceNow AI Platform Administration
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/platform-administration

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# Syslog probe

# Syslog probe {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The ServiceNow Syslog probe uses
the MID Server to deliver log messages from a ServiceNow instance to another machine,
such as a dedicated log server, using the syslog protocol over an IP network.

## How the Syslog probe works

The syslog probe is launched by a ServiceNow
[Script includes](https://www.servicenow.com/docs/access?context=c_ScriptIncludes&version=xanadu&pubname=xanadu-application-development&ft:locale=en-US) (called Syslog) that can be invoked from a [Business rules](https://www.servicenow.com/docs/access?context=c_BusinessRules&version=xanadu&pubname=xanadu-application-development&ft:locale=en-US), event, or Orchestration activity and is launched by a MID Server. A
syslog server or any server that can receive messages using the syslog protocol must be
installed on the recipient (target) machine. Typically, a dedicated log server in the
network is configured to receive all internal syslog messages. Some products that accept
syslog messages are:

* ArcSight
* Splunk
* LogLogic
* syslog-ng

## Example

The Acme Corporation wants to send a log message from their ServiceNow instance to an ArcSight
syslog server inside their corporate firewall each time a user login fails. The system
administrator uses the login.failed event to trigger a business rule that invokes the Syslog
Script Include each time a login fails. Acme's MID Server checks the ECC Queue for work and
picks up the syslog probe, which contains the log entry. The MID Server then sends the log
message to the ArcSight server, which gathers log messages from all the machine in the
internal network.  
Figure 1. Syslog probe diagram

## Code sample

The following code sample, included in an event or a business rule, directly calls the
Syslog Script Include and sends a syslog message to a designated syslog server:  

    var sl = new Syslog('FQDN of your syslog server', 'mid.server.Eclipse', 16);
    sl.log('This is a sample log message', 6);

This code does the following:

* Sends the log message to facility 16
* Sets the priority to 6 (informational)
* Sends the message to your syslog server
* Launches the probe via the MID Server named "Eclipse"