In the application web interface window, select the Settings → Logs and events → Syslog section.
On the CEF format tab, turn on the Enable the CEF log format switch.
In the Syslog facility field, the default value is Local2. The value cannot be changed.
In the Event level field, configure the export detail level:
Error to export events that involve errors.
Info to export all events.
If you want to save events in CEF format locally, enable the Save local log copy toggle switch.
Copies of the logs will be saved to the /var/log/ksmg-cef-messages file. When the log file reaches 500 MB, it is archived. If the number of archived files exceeds 10, the archive files are automatically rotated.