---
url: https://docs.realmsec.info/integration/cisco_meraki_syslog.md
---

# Cisco Meraki Syslog

Realm Security integrates with Cisco Meraki to collect event log, flow, URL, firewall, IDS/security, and Air Marshal logs from MX security appliances, MR access points, and MS switches. Meraki devices forward logs directly over syslog to a Realm Collector running in your environment.

> **Note:** This page covers sending logs directly from Meraki devices over syslog. To forward Meraki Dashboard alerts (such as device-down notifications) over HTTP webhook instead, see [Cisco Meraki Webhook](/integration/cisco_meraki_webhook).

## Prerequisites

* Administrative access to the Meraki Dashboard, with permission to edit **Network-wide > Configure > General** settings for each network you want to forward logs from.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Network connectivity from your Meraki devices to the Realm Collector on the stream port (UDP or TCP, depending on the protocol you choose below).
* If you plan to use encrypted (TLS) syslog, confirm your devices meet Meraki's minimum firmware: **MX 26.1+** for security appliances and **MR 33.1+** for access points. TLS syslog is one-way (server-authenticated) only, and Z-series teleworker gateways and MS switches do not support it at all — use plain TCP or UDP for those devices.

## Setup Cisco Meraki Syslog Source in Realm

1. Login to Realm console.
2. Go to **Sources > Add** and add a new Source.
   > **Name:** `Cisco Meraki Syslog`\
   > **Description:** `Cisco Meraki syslog logs`\
   > **Format:** `Cisco Meraki Syslog`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add a Cisco Meraki Syslog stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Cisco Meraki Syslog`\
   > **Port:** Select a unique port for this collector or use the Realm generated port.\
   > **Protocol:** Select **TCP** or **UDP** — match whichever protocol you plan to configure in the Meraki Dashboard below.\
   > **Source:** `Cisco Meraki Syslog`
5. Click **Add Stream**.
6. Take note of the port and protocol assigned to the Cisco Meraki Syslog stream. You will need them when adding the syslog server in the Meraki Dashboard.

> **Important:** Meraki syslog carries no application-layer authentication — TCP and UDP are both plaintext, and even encrypted (TLS) syslog only authenticates the server, not the sending device. Make sure the stream port is reachable only from your Meraki devices' network (for example, via firewall rules), not from the public internet.

## Configure Meraki Syslog Servers

For full background, see Meraki's [Syslog Server Overview and Configuration](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration) documentation. Repeat the steps below for each network you want to forward logs from — syslog servers are configured per network, not per organization.

### Add the Realm Collector as a Syslog Server

1. In the Meraki Dashboard, go to **Network-wide > Configure > General**. (On a single-device-type network, this section is labeled **Logging** instead of **Reporting**.)
2. In the **Reporting** section, click **Add a syslog server**.
3. Configure the server:
   > **Server IP:** IP address or FQDN of the Realm Collector (FQDN requires MX 26.1+ / MR 33.1+)\
   > **Port:** Port number assigned to the Cisco Meraki Syslog stream in Realm\
   > **Roles:** Select the log categories you want forwarded — see below
4. Select the **Roles** (message categories) to forward. Choose any combination of:
   * **Appliance Event log** / **Wireless Event log** — connectivity changes, authentication events, and other general events.
   * **Appliance Flows** / **Wireless Flows** — flow-level traffic logs.
   * **Appliance URLs** / **Wireless URLs** — HTTP(S) request logs.
   * **IDS Security Alerts** (Appliance/MR only) — intrusion detection and security filtering alerts.
   * **Air Marshal Events** (Wireless only) — rogue SSID and wireless intrusion detection events.
5. If you configured a **TCP** stream in Realm and want encrypted delivery, check **Encrypted (TLS) syslog**. Leave this unchecked for UDP, or for devices that don't meet the firmware/hardware requirements in [Prerequisites](#prerequisites).
6. Click **Update syslog servers** to save.

> **Note:** You can configure multiple syslog servers per network. Adding the Realm Collector does not remove any existing syslog destinations — Meraki sends each selected role to every configured server independently.

## Verify Configuration

1. In the Realm console, go to **Collectors**, select your collector, and check the Cisco Meraki Syslog stream for incoming events.
2. If no events arrive, confirm that your Meraki devices can reach the Realm Collector's IP address on the stream port, and that any firewalls between them allow traffic on that port and protocol.
3. Event log entries typically arrive within a few minutes of a triggering event (for example, a device connectivity change). Flow and URL logs arrive continuously once traffic matches a selected role.

## Support

For additional details, refer to Meraki's [Syslog Server Overview and Configuration](https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration) and [Syslog Event Types and Log Samples](https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples) documentation.

If you encounter any issues or require assistance, contact Realm Security support.