> For the complete documentation index, see [llms.txt](https://docs.netmap.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netmap.dev/guides/search-syslog.md).

# Search Syslog Events

Required permission: `security_view`.

API equivalents:

* `GET /api/v1/syslog/events`
* `GET /api/v1/syslog/searches`
* `POST /api/v1/syslog/searches`
* `DELETE /api/v1/syslog/searches/{search_id}`

Raw log search uses FTS5 for `q=` searches while retaining field searches.

## What This Does

Syslog search lets security and operations users inspect firewall and device events stored in NetMap's `firewall.db`. Use it to investigate blocked traffic, source/destination activity, raw log text, and device-related events.

## Before You Begin

Confirm syslog is enabled and senders are forwarding to the NetMap host. If sender restrictions are configured, the sender IP must match `SYSLOG_SENDER_ALLOWLIST`.

## Steps

1. Open Security.
2. Review current syslog status.
3. Enter a search query or set field filters.
4. Adjust time range or other filters available in the UI.
5. Save frequent searches if you need to reuse them.
6. Export results if your role has firewall export permission.

## API Example

```bash
API_URL="https://netmap.example.com"
API_KEY="<security-view-api-key>"

curl --fail-with-body \
  --url "${API_URL}/api/v1/syslog/events?q=blocked" \
  --header "X-API-Key: ${API_KEY}" \
  --header "Accept: application/json"
```

## Expected Result

The response returns a firewall event list. In the UI, matching events appear in the Security table.

## Common Problems

| Symptom                    | Likely cause                    | Fix                                         |
| -------------------------- | ------------------------------- | ------------------------------------------- |
| `403`                      | missing `security_view`         | update role permissions                     |
| no events                  | no syslog senders or wrong port | check sender config and NetMap syslog ports |
| search misses raw log text | FTS issue or wrong query        | check logs and try a field-specific filter  |
| export unavailable         | missing `firewall_export`       | use a role with export permission           |

## Related Pages

* [Syslog](/configuration/syslog.md)
* [Security Events](/using-netmap/security-events.md)
* [Ports](/reference/ports.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.netmap.dev/guides/search-syslog.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.