Log Sinks
Log Sinks continuously deliver your Audit Logs to your SIEM or log management platform. Delivery is push-based: Firezone sends your logs directly to the destination, so there are no agents to deploy and no pipelines to maintain.
Firezone supports the following destinations:
- Amazon S3
- Datadog
- Elastic
- IBM QRadar
- Microsoft Sentinel
- New Relic
- Splunk
- Generic HTTP for any other destination that accepts JSON over HTTPS
Log Sinks are managed in the admin portal under SettingsLog Sinks. Follow the setup guide above for your destination.
How delivery works
- Streams: Each Log Sink can deliver any combination of the four audit log streams: Change Logs, Session Logs, API Request Logs, and Flow Logs. All four are enabled by default.
- Backfill: The Deliver existing logs option backfills logs recorded before the sink was created, oldest first, while new logs are delivered as they arrive. It can only be selected when you create the sink and can't be added to an existing sink later.
- Cadence: New entries are delivered in batches about once per minute, and the Deliver Now action on a sink triggers a delivery immediately.
- Ordering: Entries are delivered at-least-once and in order. After an
outage, delivery resumes from the last acknowledged entry, so entries are
never skipped, though a batch that wasn't acknowledged may be delivered
again. Every entry carries a unique
log_idyou can use to deduplicate.
Monitoring and troubleshooting
The SettingsLog Sinks table shows each sink's status, destination, delivered count, backfill progress, and last delivery time. A sink is in one of four states:
| Status | Meaning |
|---|---|
| Active | Deliveries are succeeding. |
| Warning | Deliveries are failing but being retried automatically. The sink is disabled if failures persist for 24 hours. |
| Error | Delivery is stopped. Either the destination rejected deliveries due to a configuration problem, or failures persisted for 24 hours. |
| Disabled | An admin disabled the sink manually. |
Account admins are notified by email when a sink is disabled by an error. To re-enable an error-disabled sink, fix the underlying problem, then Edit the sink and Save, which clears the error and resumes delivery from the last acknowledged entry. Keep in mind that logs that expire from the 90-day retention window while a sink is stopped are not recoverable.
Deleting a sink deletes its delivery state with it, so re-creating the sink starts over as a new one, delivering logs recorded from creation onward, plus a full backfill if Deliver existing logs is selected.
Need help? See all support options.