Skip to content

Collector

Forwarding system tenant logs to a central LogMan.io

This guide describes how to forward logs from the system tenant on a satellite TeskaLabs LogMan.io deployment to a supersystem tenant on a central TeskaLabs LogMan.io system.

The satellite keeps collecting and processing its own system logs. In parallel, LogMan.io Integration Service (lmio-integ) forwards raw events over TCP to a dedicated LogMan.io Collector on the satellite. That collector is provisioned to a receiving tenant on the central system (recommended name: supersystem) and ships the data over CommLink.

How to Connect Ubiquiti Dream Machine to LogMan.io to Collect and Monitor NetFlows

A Ubiquiti UniFi Dream Machine (UDM) is a popular choice for small and mid-sized networks. It handles routing, switching, and Wi-Fi from a single appliance — but by default, it is something of a black box for your SIEM. Its NetFlow/IPFIX export is an excellent way to lift the hood: every conversation that crosses the gateway can be analyzed, searched, and correlated inside TeskaLabs LogMan.io.

This guide walks through the full path, from enabling NetFlow export on the UDM to monitoring the collected flow records in LogMan.io. The setup described here is the exact configuration we run in production at TeskaLabs on our own office router, so every step below is verified to work.

Fixing Microsoft 365 Message Trace collection

Microsoft has changed the way Message Trace data is retrieved from Exchange Online. The original Reporting Webservice API that TeskaLabs LogMan.io used for Message Trace collection is being deprecated and replaced by a new Microsoft Graph API. If you collect Microsoft 365 Message Trace logs, you must update your Azure / Entra ID configuration, otherwise Message Trace collection will stop working.