Workspace ONE UEM supports exporting access logs to the syslog server for the Proxy and the Per-App Tunnel components of VMware Tunnel.
Access logs are generated in the standard HTTP Apache logs format and directly transferred to the syslog host you defined. They are not stored locally on the VMware Tunnel server.
In relay-endpoint deployments, the relay server writes the access logs, in a cascade deployment, the back-end server writes the access logs and in a basic deployment, the basic server writes the access logs.
For instructions on enabling access log and syslog integration, see Configure Advanced Settings for the Proxy Component and Configure Advanced Settings for the Per-App Tunnel Component.
Under high loads and peak hours, average of 10,000 devices for an hour roughly generates around 0.5 GB of logs to the syslog server. However, your mileage might depend on the load that you might have on your VMware Tunnel server. For additional support, contact your syslog administrator.
You must enable access logs before you install any of the components. Any changes you make to the access logs configuration on the Workspace ONE UEM console require reinstallation of the VMware Tunnel server.
KKDCP Access Logs
The path for KKDCP logs for VMware Tunnel for Linux is: