> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/ubiquiti.md).

# Ubiquiti

Receives syslog from Ubiquiti and UniFi devices over UDP on a configurable listen port and parses the messages into structured logs. Each device sends syslog directly to the collector, so the collector must be reachable from the devices themselves.

### Supported Telemetry

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux    |         | ✓    |        |
| Windows  |         | ✓    |        |
| macOS    |         | ✓    |        |

### Prerequisites

You need one or more Ubiquiti or UniFi devices configured to forward syslog to the collector, and a collector reachable from those devices on the chosen UDP port.

* **Collector side:** open the configured UDP listen port (default `5140`) in any host and cloud firewalls between the devices and the collector. Binding to a privileged port (below 1024) requires the collector to run with root/Administrator privileges, so the default `5140` avoids that.
* **Device side:** enable remote syslog on the Ubiquiti/UniFi devices and point the syslog server address and port at the collector. UniFi devices send syslog directly to the configured server; the UniFi Network controller distributes the setting but does not proxy or forward the logs. Set up remote logging using Ubiquiti's official documentation rather than steps reproduced here.
  * [UniFi System Logs & SIEM Integration](https://help.ui.com/hc/en-us/articles/33349041044119-UniFi-System-Logs-SIEM-Integration)

### Configuration

<figure><img src="/files/djqocJGUagmRGcEMQTMe" alt="Bindplane docs - Ubiquiti - image 1"><figcaption></figcaption></figure>

**Logs**

| Parameter      | Type    | Required | Default | Description                                                                     |
| -------------- | ------- | -------- | ------- | ------------------------------------------------------------------------------- |
| Listen Address | String  | No       | 0.0.0.0 | An IP address for the agent to bind. Typically 0.0.0.0 for most configurations. |
| Listen Port    | Integer | No       | 5140    | A UDP port which the agent will listen for syslog messages.                     |

**Advanced**

| Parameter | Type     | Required | Default | Description                                  |
| --------- | -------- | -------- | ------- | -------------------------------------------- |
| Timezone  | Timezone | No       | UTC     | The timezone to use when parsing timestamps. |
| Parse     | Boolean  | No       | true    | Parses the log fields into structured data.  |

### Examples

#### Receive UniFi syslog on a non-privileged port

Bind to all interfaces on UDP `5140` and parse the incoming messages into structured fields. Point the UniFi Remote Logging server address at this collector's IP and set its port to `5140`.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: ubiquiti
spec:
  type: ubiquiti
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: parse
      value: true
```

### Configuration Tips

* Ubiquiti and UniFi devices send syslog over UDP. Make sure the device's syslog port matches the collector's Listen Port.
* The default Listen Port `5140` is non-privileged, so the collector does not need elevated privileges. Only choose a port below 1024 (for example `514`) if you run the collector as root/Administrator.
* Leave Parse enabled to get structured fields. Disable it only when you want to forward the raw syslog message unmodified.
* Set Timezone to match the devices when their timestamps are not in UTC, so parsed event times are correct.

### Troubleshooting

#### No logs arriving

Symptoms: the source is running but no Ubiquiti logs reach the pipeline.

Solutions:

1. Confirm each device's Remote Logging is enabled and points at the collector's IP and the configured UDP port.
2. Verify the Listen Port matches the port set on the devices and that host/cloud firewalls allow inbound UDP on that port.
3. Confirm the devices can reach the collector directly, since UniFi devices send syslog themselves rather than through the controller.

#### Permission denied binding the listen port

Symptoms: the collector fails to start or bind the port.

Solutions:

1. Use the default `5140` or another port above 1024, which does not require elevated privileges.
2. If you must use a port below 1024 (such as `514`), run the collector with root/Administrator privileges.

#### Logs arrive but fields are not parsed

Symptoms: events show up but lack structured fields.

Solutions:

1. Confirm Parse is enabled.
2. Check that Timezone matches the devices so timestamps parse correctly.

### Standalone Source

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: ubiquiti
spec:
  type: ubiquiti
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: timezone
      value: "UTC"
    - name: parse
      value: true
```

### Related Resources

* [UniFi System Logs & SIEM Integration](https://help.ui.com/hc/en-us/articles/33349041044119-UniFi-System-Logs-SIEM-Integration)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/ubiquiti.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.