{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "item": { "id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "slug": "account-for-the-axis-log-gap-when-remote-forwarding-is-disabled", "url": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled.md", "json": "https://update.dsesecurity.com/api/v1/posts/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/" }, "title": "Account for the Axis log gap when remote forwarding is disabled", "summary": "Treat disabled Axis remote syslog forwarding as a documented collection gap without assuming buffered replay. Keep the intended message type and severity selection visible when forwarding is restored.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-29T20:33:27+00:00", "modified_at": "2026-10-29T20:33:34+00:00", "reviewed_on": "2026-10-29", "reading_minutes": 3, "word_count": 485, "potentially_affected": "Axis products exposing the documented Remote Syslog interface; confirm actual device, hardware and software applicability before applying the proposed checks.", "dse_recommendation": "DSE recommends recording a remote-forwarding interruption as an evidence gap with a named owner and an explicit restoration check.", "primary_source": { "name": "Axis Communications — Remote Syslog", "url": "https://developer.axis.com/vapix/network-video/remote-syslog/", "published_on": null, "authority": "Axis Communications" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Name the logging gap before disabling forwarding. Record its beginning and end, and verify resumed collection without describing a later test message as recovery of everything that happened during the interruption.

\n

Source fact: documented behavior

\n

Axis’s Remote Syslog describes stopping remote log transmission without buffering messages.

\n

The documented disable method stops forwarding, while enable starts sending and test sends test logs to the configured receivers.

\n

The source distinguishes Audit user-behavior messages from All, and its Warning example includes warning and more severe messages.

\n

What the source does not establish

\n

Do not generalize the disabled-forwarding description into a complete retry or storage policy for every network outage. This article does not establish local-log retention, collector durability or complete incident reconstruction. Keep forwarding recovery separate from the disposition of missing evidence.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends recording a remote-forwarding interruption as an evidence gap with a named owner and an explicit restoration check.

\n
    \n
  1. Before an approved interruption, preserve the current remote-log configuration and identify the receiver owner. Write the intended message population and the reason for disabling it. Have the incident-response owner decide how an uncollected interval will be marked in subsequent searches instead of silently presenting it as a quiet system.
    2. \n
  2. Record the actual disable operation and time through the supported workflow. During the controlled exercise, keep a harmless separately recorded marker timeline if the plan requires comparison. Do not generate sensitive or disruptive activity merely to populate a log-gap demonstration, and do not assume another logging path preserves the same events without its own evidence.
    3. \n
  3. Restore the approved configuration and forwarding state. Use the supported test operation and a receiver-side search to check that new collection resumes. Compare the saved message-type and severity selection with the initial requirement before changing a threshold to make a missing record appear. Route unresolved forwarding or evidence gaps to their respective owners.
    4. \n
\n

Verification and evidence

\n

Retain the approved interruption record, before-and-after settings, sanitized operation results and receiver observations. Label test messages generated after restoration separately from any independently established records for the disabled interval. Require the reviewer to identify exactly which time range remains unverified.

\n

In a proposed paper review, give the operator a successful post-restoration test and an earlier disabled period. Ask what the test proves and what it leaves unanswered. Keep any collector-outage recovery exercise under its own supported plan. This article does not report performed forwarding changes, a recovered backlog or complete log coverage.

\n

Official references

\n\n

Source review completed October 29, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.

\n", "content_text": "Bottom line: Name the logging gap before disabling forwarding. Record its beginning and end, and verify resumed collection without describing a later test message as recovery of everything that happened during the interruption.\nSource fact: documented behavior\nAxis’s Remote Syslog describes stopping remote log transmission without buffering messages.\nThe documented disable method stops forwarding, while enable starts sending and test sends test logs to the configured receivers.\nThe source distinguishes Audit user-behavior messages from All, and its Warning example includes warning and more severe messages.\nWhat the source does not establish\nDo not generalize the disabled-forwarding description into a complete retry or storage policy for every network outage. This article does not establish local-log retention, collector durability or complete incident reconstruction. Keep forwarding recovery separate from the disposition of missing evidence.\nApplicability questions\n\nWhy is forwarding being disabled, and who accepts the collection gap?\nWhich message types and severity threshold must be restored?\nWhich receiver and operator will verify resumed collection?\nWhat separately supported evidence can address the interrupted interval?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording a remote-forwarding interruption as an evidence gap with a named owner and an explicit restoration check.\n\nBefore an approved interruption, preserve the current remote-log configuration and identify the receiver owner. Write the intended message population and the reason for disabling it. Have the incident-response owner decide how an uncollected interval will be marked in subsequent searches instead of silently presenting it as a quiet system.\nRecord the actual disable operation and time through the supported workflow. During the controlled exercise, keep a harmless separately recorded marker timeline if the plan requires comparison. Do not generate sensitive or disruptive activity merely to populate a log-gap demonstration, and do not assume another logging path preserves the same events without its own evidence.\nRestore the approved configuration and forwarding state. Use the supported test operation and a receiver-side search to check that new collection resumes. Compare the saved message-type and severity selection with the initial requirement before changing a threshold to make a missing record appear. Route unresolved forwarding or evidence gaps to their respective owners.\n\nVerification and evidence\nRetain the approved interruption record, before-and-after settings, sanitized operation results and receiver observations. Label test messages generated after restoration separately from any independently established records for the disabled interval. Require the reviewer to identify exactly which time range remains unverified.\nIn a proposed paper review, give the operator a successful post-restoration test and an earlier disabled period. Ask what the test proves and what it leaves unanswered. Keep any collector-outage recovery exercise under its own supported plan. This article does not report performed forwarding changes, a recovered backlog or complete log coverage.\nOfficial references\n\nRemote Syslog — Axis Communications; official VAPIX documentation.\n\nSource review completed October 29, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.", "content_markdown": "Bottom line: Name the logging gap before disabling forwarding. Record its beginning and end, and verify resumed collection without describing a later test message as recovery of everything that happened during the interruption.\n\n## Source fact: documented behavior\n\nAxis’s [Remote Syslog](https://developer.axis.com/vapix/network-video/remote-syslog/) describes stopping remote log transmission without buffering messages.\n\nThe documented disable method stops forwarding, while enable starts sending and test sends test logs to the configured receivers.\n\nThe source distinguishes Audit user-behavior messages from All, and its Warning example includes warning and more severe messages.\n\n## What the source does not establish\n\nDo not generalize the disabled-forwarding description into a complete retry or storage policy for every network outage. This article does not establish local-log retention, collector durability or complete incident reconstruction. Keep forwarding recovery separate from the disposition of missing evidence.\n\n## Applicability questions\n\n- Why is forwarding being disabled, and who accepts the collection gap?\n\n- Which message types and severity threshold must be restored?\n\n- Which receiver and operator will verify resumed collection?\n\n- What separately supported evidence can address the interrupted interval?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends recording a remote-forwarding interruption as an evidence gap with a named owner and an explicit restoration check.\n\n- Before an approved interruption, preserve the current remote-log configuration and identify the receiver owner. Write the intended message population and the reason for disabling it. Have the incident-response owner decide how an uncollected interval will be marked in subsequent searches instead of silently presenting it as a quiet system.\n\n- Record the actual disable operation and time through the supported workflow. During the controlled exercise, keep a harmless separately recorded marker timeline if the plan requires comparison. Do not generate sensitive or disruptive activity merely to populate a log-gap demonstration, and do not assume another logging path preserves the same events without its own evidence.\n\n- Restore the approved configuration and forwarding state. Use the supported test operation and a receiver-side search to check that new collection resumes. Compare the saved message-type and severity selection with the initial requirement before changing a threshold to make a missing record appear. Route unresolved forwarding or evidence gaps to their respective owners.\n\n## Verification and evidence\n\nRetain the approved interruption record, before-and-after settings, sanitized operation results and receiver observations. Label test messages generated after restoration separately from any independently established records for the disabled interval. Require the reviewer to identify exactly which time range remains unverified.\n\nIn a proposed paper review, give the operator a successful post-restoration test and an earlier disabled period. Ask what the test proves and what it leaves unanswered. Keep any collector-outage recovery exercise under its own supported plan. This article does not report performed forwarding changes, a recovered backlog or complete log coverage.\n\n## Official references\n\n- [Remote Syslog](https://developer.axis.com/vapix/network-video/remote-syslog/) — Axis Communications; official VAPIX documentation.\n\nSource review completed October 29, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "url": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-29" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Account for the Axis log gap when remote forwarding is disabled", "item": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/#article", "identifier": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "url": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/", "headline": "Account for the Axis log gap when remote forwarding is disabled", "description": "Treat disabled Axis remote syslog forwarding as a documented collection gap without assuming buffered replay.", "abstract": "Treat disabled Axis remote syslog forwarding as a documented collection gap without assuming buffered replay. Keep the intended message type and severity selection visible when forwarding is restored.", "articleBody": "Bottom line: Name the logging gap before disabling forwarding. Record its beginning and end, and verify resumed collection without describing a later test message as recovery of everything that happened during the interruption.\nSource fact: documented behavior\nAxis’s Remote Syslog describes stopping remote log transmission without buffering messages.\nThe documented disable method stops forwarding, while enable starts sending and test sends test logs to the configured receivers.\nThe source distinguishes Audit user-behavior messages from All, and its Warning example includes warning and more severe messages.\nWhat the source does not establish\nDo not generalize the disabled-forwarding description into a complete retry or storage policy for every network outage. This article does not establish local-log retention, collector durability or complete incident reconstruction. Keep forwarding recovery separate from the disposition of missing evidence.\nApplicability questions\n\nWhy is forwarding being disabled, and who accepts the collection gap?\nWhich message types and severity threshold must be restored?\nWhich receiver and operator will verify resumed collection?\nWhat separately supported evidence can address the interrupted interval?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording a remote-forwarding interruption as an evidence gap with a named owner and an explicit restoration check.\n\nBefore an approved interruption, preserve the current remote-log configuration and identify the receiver owner. Write the intended message population and the reason for disabling it. Have the incident-response owner decide how an uncollected interval will be marked in subsequent searches instead of silently presenting it as a quiet system.\nRecord the actual disable operation and time through the supported workflow. During the controlled exercise, keep a harmless separately recorded marker timeline if the plan requires comparison. Do not generate sensitive or disruptive activity merely to populate a log-gap demonstration, and do not assume another logging path preserves the same events without its own evidence.\nRestore the approved configuration and forwarding state. Use the supported test operation and a receiver-side search to check that new collection resumes. Compare the saved message-type and severity selection with the initial requirement before changing a threshold to make a missing record appear. Route unresolved forwarding or evidence gaps to their respective owners.\n\nVerification and evidence\nRetain the approved interruption record, before-and-after settings, sanitized operation results and receiver observations. Label test messages generated after restoration separately from any independently established records for the disabled interval. Require the reviewer to identify exactly which time range remains unverified.\nIn a proposed paper review, give the operator a successful post-restoration test and an earlier disabled period. Ask what the test proves and what it leaves unanswered. Keep any collector-outage recovery exercise under its own supported plan. This article does not report performed forwarding changes, a recovered backlog or complete log coverage.\nOfficial references\n\nRemote Syslog — Axis Communications; official VAPIX documentation.\n\nSource review completed October 29, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.", "datePublished": "2026-10-29T20:33:27+00:00", "dateModified": "2026-10-29T20:33:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/account-for-the-axis-log-gap-when-remote-forwarding-is-disabled/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for the Axis log gap when remote forwarding is disabled" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 485, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Axis Communications — Remote Syslog", "url": "https://developer.axis.com/vapix/network-video/remote-syslog/" } } ] } }