All Products
Search

This Product

    Web Application Firewall:Integrate WAF logs into a Syslog server

    Document Center

    Web Application Firewall:Integrate WAF logs into a Syslog server

    Last Updated:Mar 31, 2026

    Forward Web Application Firewall (WAF) access logs to a Syslog server using Python Program. This lets you centralize WAF logs in your security operations center (SOC) to meet regulatory and audit requirements.

    How it works

    WAF writes access logs to Simple Log Service (SLS). Python Program runs on an Elastic Compute Service (ECS) instance, reads from SLS using a consumer group, and forwards each log entry to your Syslog server over UDP or TCP.

    Architecture

    Python Program uses the SLS consumer library — an advanced consumption mode built on LogHub consumer groups. Consumer groups handle offset tracking and fault tolerance automatically, so Python Program focuses entirely on forwarding logic.

    The Syslog channel transmits log data over UDP or TCP without encryption. For production environments with strict security requirements, route logs through a local Syslog proxy on the same host before forwarding to your remote Syslog server over a secured channel.

    Prerequisites

    Before you begin, ensure that you have:

    • Log Service for WAF enabled, with log collection turned on for your domain name. See Get started with the Log Service for WAF feature

    • A Linux ECS instance running Ubuntu with the following minimum specifications:

      • 2.0 GHz processor, 8 cores

      • 32 GB memory

      • At least 2 GB available disk space (10 GB or more recommended)

    • A Syslog server with UDP port 514 open to receive Syslog data

    Set up Python Program

    Step 1: Install dependencies

    Connect to your ECS instance over SSH or through the ECS console. See Methods for connecting to an ECS instance.

    Install Python 3, pip, and the SLS Python SDK:

    apt-get update
apt-get install -y python3-pip python3-dev
cd /usr/local/bin
ln -s /usr/bin/python3 python
pip3 install --upgrade pip
pip install aliyun-log-python-sdk

    For SDK documentation, see aliyun-log-python-sdk user guide.

    Step 2: Download the sample script

    wget https://raw.githubusercontent.com/aliyun/aliyun-log-python-sdk/master/tests/consumer_group_examples/sync_data_to_syslog.py

    The full source is available on GitHub.

    Step 3: Configure Python Program

    Open sync_data_to_syslog.py and set the following parameters.

    Log Service parameters

    endpoint = os.environ.get('SLS_ENDPOINT', 'http://ap-southeast-1.log.aliyuncs.com')
accessKeyId = os.environ.get('SLS_AK_ID', 'Your AccessKey ID')
accessKey = os.environ.get('SLS_AK_KEY', 'Your AccessKey secret')
project = os.environ.get('SLS_PROJECT', 'waf-project-548613414276****-ap-southeast-1')
logstore = os.environ.get('SLS_LOGSTORE', 'waf-logstore')
consumer_group = os.environ.get('SLS_CG', 'WAF-SLS')
    ParameterDescription
    SLS_ENDPOINTThe Log Service endpoint for your project's region. See Endpoints.
    SLS_AK_IDYour AccessKey ID. Retrieve it from the User Management console. AccessKey
    SLS_AK_KEYYour AccessKey secret.
    SLS_PROJECTThe SLS project name for your WAF instance. Project names start with waf-project. Projects in the China (Hangzhou) region belong to WAF instances in the Chinese mainland; projects in Singapore belong to WAF instances outside the Chinese mainland. To find your project name, log in to the Log Service consoleLog Service console. 日志项目
    SLS_LOGSTOREThe Logstore name within the project. Click your WAF project in the Log Service consoleLog Service console to view the Logstore name. 日志库
    SLS_CGThe consumer group name. The default value WAF-SLS works for most deployments.

    Syslog parameters

    settings = {
    "host": "1.2.xx.xx",
    "port": 514,
    "protocol": "udp",
    "sep": ",",
    "cert_path": None,
    "timeout": 120,
    "facility": syslogclient.FAC_USER,
    "severity": syslogclient.SEV_INFO,
    "hostname": None,
    "tag": None
}
    ParameterDescription
    hostThe IP address or hostname of your Syslog server.
    portThe port for Syslog data. Supported values: 514 (UDP) and 1468 (TCP).
    protocolThe transport protocol: udp or tcp. Match this to your Syslog server's configuration.
    sepThe delimiter used to separate key-value pairs in each Syslog message.
    facilityThe Syslog facility code that classifies the log source. Syslog uses facility codes to route messages to different log files on the server. The default FAC_USER is appropriate for general application logs. For all available values, see the syslogclient documentation.
    severityThe Syslog severity level for all forwarded messages. The default SEV_INFO is appropriate for WAF access logs.
    timeoutThe connection timeout in seconds. The default is 120.
    cert_pathThe path to the TLS certificate file. Set this when using TLS over TCP. Leave as None for unencrypted connections.

    Step 4: Start Python Program

    python sync_data_to_syslog.py

    When Python Program starts successfully, the output looks similar to:

    *** start to consume data...
consumer worker "WAF-SLS-1" start
heart beat start
heart beat result: [] get: [0, 1]
Get data from shard 0, log count: 6
Complete send data to remote
Get data from shard 0, log count: 2
Complete send data to remote
heart beat result: [0, 1] get: [0, 1]

    WAF access logs are now forwarded to your Syslog server.

    What's next