Skip to main content
Sumo Logic

Collect Logs for the Zscaler Private Access (ZPA) App

This page provides instructions for configuring log and metric collection for the Sumo Logic App for ZPA.

Zscaler Private Access uses the Log Streaming Service (LSS), to stream logs from the Zscaler service and deliver them to the Sumo Logic Hosted collector via Syslog.

LSS is deployed using two components, a log receiver and a ZPA App Connector. LSS resides in ZPA and initiates a log stream through a ZPA Public Service Edge (formerly Zscaler Enforcement Node or ZEN). The App Connector resides in your company's enterprise environment. It receives the log stream and then forwards it to Sumo Logic Cloud Syslog.

To collect logs for Zscaler Private Access, perform these steps, detailed in the following sections:

  1. Configure Sumo Logic Hosted Collector and a Cloud Syslog Source
  2. Configure App Connector in ZPA
  3. Deploy an App Connector on a Supported Platform
  4. Configure Log Receivers in ZPA to send logs to Sumo Logic

Configure Sumo Logic Hosted Collector and a Cloud Syslog Source

To collect logs for ZPA, do the following in Sumo Logic:

  1. Configure a Hosted Collector.

  2. Perform the steps in Configure a Cloud Syslog Source. and configure the following Source fields:

    • Name. (Required) A name is required. Description is optional. 

    • Source Category. (Required) [Provide a realistic Source Category example for this data type.] The Source Category metadata field is a fundamental building block to organize and label Sources.
      For details see Best Practices.

  3. In the Advanced section, specify the following configurations:

    • Enable Timestamp Parsing. True

    • Time Zone. Use time zone from log file. If none is detected use: Use Collector Default.

    • Timestamp Format. Auto Detect

  4. In the Processing Rules for Logs section, add a Processing Rule:

    • Name: Remove Syslog String

    • Filter: (\<\d+\>1 - - - - - - \{)

    • Type: Mask messages that match

    • Mask String: {

  1. Click Save

Configure App Connector in ZPA

Configure a new App Connector in ZPA. Copy the provisioning key created/selected during App Connector configuration. 

Deploy an App Connector on a Supported Platform

After you add an App Connector, you must deploy it. Deployment consists of installing the App Connector and also enrolling the App Connector, which allows the App Connector to obtain a TLS client certificate that it must use to authenticate itself to the ZPA cloud. After deployment, the App Connector is ready to send logs to Sumo Logic.

Before you begin a deployment, read App Connector Deployment Prerequisites which provides detailed information on VM image sizing and scalability, supported platform requirements, deployment best practices, and other essential guidelines.

The deployment process differs depending on the platform used for the App Connector. Zscaler recommends that App Connectors be deployed in pairs, to ensure continuous availability during software upgrades. 

To deploy the App Connector, see the Deployment Guide for your platform.

Configure Log Receivers in ZPA to send logs to Sumo Logic

Once you have deployed the App Connector, configure log receivers to send logs to the Sumo Logic cloud syslog endpoint using the following steps:

  1. Log into your ZPA system.

  2. Go to Administration > Log Receivers.

  3. Click Add Log Receiver.

  4. In the Add Log Receiver window, configure the following tabs: 

    1. Log Receiver

      

  1. Name: Enter a name for the log receiver. The name cannot contain special characters, with the exception of periods (.), hyphens (-), and underscores ( _ ).

  2. Description: (Optional) Enter a description.

  3. Domain or IP Address: Enter the Domain name from the Sumo Logic Cloud Syslog Source.

  4. TCP Port: Enter the TCP port number from the Sumo Logic Cloud Syslog Source. Default: 6514

  5. TLS Encryption: Select Enabled.

  6. Connector Groups: Choose the App Connector groups that can forward logs to the receiver, and click Done. You can search for a specific group, click Select All to apply all groups, or click Clear Selection to remove all selections.

  7. Click Next.

  1. Log Stream

    1. In the Log Stream tab, select a Log Type from the drop-down menu:

      1. User Activity: Information on end user requests to applications. To learn more, see User Activity Log Fields.

      2. User Status: Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.

      3. Connector Status: Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.

      4. Browser Access: HTTP log information related to Browser Access. To learn more, see Browser Access Log Fields and About Browser Access.

      5. Audit Logs: Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.

    2. In the Log Template field, select JSON.

    3. The default Log Stream Content that is displayed will change based on the Log Type and Log Template you selected in previous steps.

      You can also edit the log stream content within the text field in order to capture specific fields and create a Custom log template. To learn more, see Understanding the Log Stream Content Format.

      Edit the the log stream content, paste the following text in the beginning of the template:

<165>1 - - - - - - <Syslog Token> 

For Syslog Token, enter the token from the Sumo Logic Cloud Syslog Source. The token should end with @41123. This number is the Sumo Logic Private Enterprise Number (PEN).

           

  1. You can define a streaming Policy for the log receiver. For example, you can create a policy where the receiver will only capture logs for a specified segment group or a specific set of session status error codes. The criteria you can use is dependent upon the Log Type you selected. For various options to define a streaming policy, see ZPA help.

  2. Click Next.

  1. Review

    1. In the Review tab, review your log receiver configuration, and click Save.

  1. Repeat the previous steps for all the Log Types:

    1. User Activity: Information on end user requests to applications. To learn more, see User Activity Log Fields.

    2. User Status: Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.

    3. Connector Status: Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.

    4. Browser Access: HTTP log information related to Browser Access. To learn more, see Browser Access Log Fields and About Browser Access.

    5. Audit Logs: Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.

  2. The end result should look like below:

  1. At this point, ZPA should start sending logs to Sumo Logic.