_system_logging.html.md.erb

If you forward logging messages to an external Reliable Event Logging Protocol (RELP) server, complete the following steps:

1. Select the **System Logging** section that is located within your PAS **Settings** tab.
  <%= image_tag("updated-system-logging.png") %>
1. Enter the IP address of your syslog server in **Address**.
1. Enter the port of your syslog server in **Port**. The default port for a syslog server is `514`.
<p class="note"><strong>Note</strong>: The host must be reachable from the PAS network, accept TCP connections, and use the RELP protocol. Ensure your syslog server listens on external interfaces.</p>
1. Select a **Transport Protocol** to use when forwarding logs.
1. If you plan to use TLS encryption when sending logs to the remote server, select **Yes** when answering the **Encrypt syslog using TLS?** question.
  1. In the **Permitted Peer** field, enter either the name or SHA1 fingerprint of the remote peer.
  1. In the **TLS CA Certificate** field, enter the TLS CA Certificate for the remote server.
1. For the **Syslog Drain Buffer Size**, enter the number of messages the Doppler server can hold from Metron agents before the server starts to drop them. See the [Loggregator Guide for Cloud Foundry Operators](../loggregator/log-ops-guide.html) topic for more details.
1. The **Include container metrics in Syslog Drains** checkbox is checked by default. This enables the [CF Drain CLI plugin](https://github.com/cloudfoundry/cf-drain-cli) to set the app container to deliver container metrics to a syslog drain. Developers can then monitor the app container based on those metrics. If you would like to disable this feature, uncheck this checkbox.
1. If you want to include security events in your log stream, select the **Enable Cloud Controller security event logging** checkbox. This logs all API requests, including the endpoint, user, source IP address, and request result, in the Common Event Format (CEF).
1. If you want to transmit logs over TCP, select the **Use TCP for file forwarding local transport** checkbox. This prevents log truncation, but may cause performance issues.
1. If you want to forward DEBUG syslog messages to an external service, disable the **Don't Forward Debug Logs** checkbox.
This checkbox is enabled in PAS by default.
  <p class="note"><strong>Note</strong>: Some PAS components generate a high volume of DEBUG syslog messages.
  Using the <strong>Don't Forward Debug Logs</strong> checkbox prevents them from being forwarded to external services. PAS still writes the messages to the local disk.</p>
1. If you want to specify a custom syslog rule, enter it in the **Custom rsyslog Configuration** field in [RainerScript](http://www.rsyslog.com/doc/v8-stable/rainerscript/index.html) syntax. For more information about customizing syslog rules, see [Customizing Syslog Rules](./custom-syslog-rules.html).
1. Click **Save**.

To configure Ops Manager for system logging, see the [Settings](./pcf-interface.html#settings) section in the _Understanding the Ops Manager Interface_ topic.