Ubiquiti UniFi and EdgeRouter: send syslog and NetFlow to MobiObs

Before you start

The MobiObs device is 10.20.4.9 in the examples; use the address on its Network screen. Android does not let apps listen on ports below 1024, and MobiObs uses the same ports on every platform, so MobiObs uses these defaults:

UniFi menus move between releases of the UniFi Network application. The paths below match Ubiquiti’s help articles for current releases (10.x and 11.x). If a menu is not where this guide says, search Settings for SIEM or NetFlow.

UniFi activity logs

1. In UniFi Network, go to Settings > CyberSecure > Traffic Logging. Some releases show the same settings under Integrations as System Logging / SIEM.
2. Under Activity Logging (Syslog), select SIEM Server as the destination.
3. Choose the log categories to export, enter 10.20.4.9 as the IP address and 5514 as the port, and apply the change.

UniFi exports these logs in CEF (Common Event Format), which MobiObs parses into vendor, product, event and extension fields. The categories cover monitoring (Wi-Fi, wired and guest hotspot events), internet outages and failover, PoE and power redundancy, security (firewall, honeypot and intrusion prevention) and system events such as admin activity, device and VPN changes. For Wi-Fi complaints, the Monitoring and System categories are the useful ones; for a blocked application, add Security.

Ubiquiti notes that per-connection traffic logs are not yet part of the SIEM export, so use NetFlow for traffic. If you run a self-hosted UniFi Network server, note that it uses udp/5514 itself for remote syslog capture; this only matters if MobiObs runs on that same computer.

UniFi gateway NetFlow

1. Go to Settings > CyberSecure > Traffic Logging and enable NetFlow (IPFIX).
2. Enter 10.20.4.9 as the collector address and 2055 as the port, and apply.

NetFlow export arrived in UniFi Network 8.5 with a choice of versions 10 (IPFIX), 9 and 5, a configurable collector address and port, and configurable rates. It needs UniFi gateway firmware 4.1 or later and is not available on the UniFi Express and UXG-Lite. MobiObs decodes IPFIX, v9 and v5 on the same port, so any version works; IPFIX and v9 carry more fields. The export is sampled, so treat totals as estimates.

UniFi and SNMP

UniFi Network supports SNMP polling (v1, v2c and v3) but, as of Ubiquiti’s current documentation, not SNMP traps, so there is nothing to send to udp/1162. The activity log categories above carry the same kinds of events, such as ports and devices going offline.

EdgeRouter (EdgeOS)

Ubiquiti documents EdgeOS remote syslog as BSD format over udp/514, with a port that cannot be changed, and the SNMP trap target as an address without a port. So an EdgeRouter needs a relay or destination NAT in front of MobiObs. The configuration on the router itself is short:

EdgeOS: remote syslog and SNMP traps to a relay at 192.0.2.50

configure
set system syslog host 192.0.2.50 facility all level info
set service snmp community MOBIOBS-RO authorization ro
set service snmp trap-target 192.0.2.50
commit ; save
exit

Here 192.0.2.50 is a Linux host (or a laptop) that relays udp/514 to 10.20.4.9:5514 and udp/162 to 10.20.4.9:1162. The port 514 guide shows a two-line destination NAT that keeps the router’s source address, and the Linux guide shows rsyslog and snmptrapd relays. Set level to debug only briefly.

EdgeRouters can also export NetFlow through the flow-accounting configuration, but Ubiquiti does not publish a current reference for its commands, so this guide does not give them. If the EdgeRouter is managed by UISP, use UISP’s own NetFlow setting.

Verify it works

• Logs. UniFi events appear as CEF messages with the vendor Ubiquiti and product UniFi Network. To create one on demand, restart an access point from UniFi Network or reconnect a test client. EdgeRouter messages appear with the router’s hostname; after a configuration commit, EdgeOS logs the change.
• Flows. Within a few minutes of enabling NetFlow, Flows charts bytes over time and lists top talkers, destinations and ports through the gateway.
• Traps. With an EdgeRouter relay in place, unplugging and reconnecting a test port produces linkDown and linkUp in the SNMP Traps screen.
• Sources. Lists every sender that reached the device, which shows at once whether the gateway, the UniFi application or the relay is the one sending.

Troubleshooting

• No UniFi logs. Check that the destination is SIEM Server rather than Internally Stored, that categories are selected, and that the port is 5514.
• No flows. Check the gateway model and firmware (4.1 or later; not UniFi Express or UXG-Lite), and that the MobiObs device is reachable from the gateway’s LAN interface.
• The device is on a guest network. UniFi guest networks and client device isolation block traffic to other clients. Use a staff or management network for the MobiObs device.
• EdgeRouter messages show the relay’s address. That is expected with an rsyslog relay; use destination NAT to keep the router’s address.