The endpoint server writes the access logs.
For instructions on enabling access log and syslog integration, see Configure Advanced Settings.
You must enable access logs before you install any of the components. Any changes you make to the access logs configuration on the AirWatch Console require reinstallation of the VMware Tunnel server.
Using a Linux Server to act as a Syslog Host
Most Linux servers by default have support for syslog. To enable a Linux server to act as syslog host, navigate to rsyslog.conf:
Uncomment the features under UDP syslog reception:
# Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514
To view the logs, enter the following command:
tail –f /var/log/messages | grep <rsyslog_dent>
Make sure UDP port 514 is open routing to the syslog server:
-A INPUT –p udp –m udp –dport 514 –j ACCEPT