Review each TrueNAS syslog destination and the forwarding threshold

Bottom line: Write down which messages each intended receiver should obtain before saving remote logging settings. Treat a second destination as another configuration to verify, rather than evidence that the complete logging path is automatically redundant.

Source fact: what the authority says

The TrueNAS system-logging guide allows a syslog server or an array of two servers, each with its own host, transport and TLS certificate settings. It says certificates must be added to TrueNAS before selecting TLS transport. The selected Syslog Level is the minimum priority sent remotely; the system forwards messages at or above that level. The guide says entries are written locally as well as sent to the remote server and provides an Add Syslog Server step for a second destination.

What the source does not establish

These settings do not establish durable receipt, failover, a particular retry policy or completeness of an investigator’s search. DSE uses this article for the TrueNAS receiver and priority-selection decision. The collector’s retention, access controls and transport validation require their own evidence.

Applicability questions

• Which one or two receivers are intended, and who owns each endpoint?
• What priority threshold and message classes must the investigation workflow receive?
• What transport and certificate reference are selected for each receiver?
• How will an operator distinguish local observation, remote receipt and downstream search availability?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a receiver worksheet with separate rows for the first and second destination. Record each host and port, transport, certificate reference where applicable and owner. Record the selected Syslog Level once as the reviewed forwarding threshold alongside the endpoint rows. Check the actual saved values rather than assuming the second endpoint repeats the first.

Define proposed test messages on both sides of the selected priority boundary using an approved method for the installed system. Give the test inputs harmless identifiers and retain their intended class and time. Ask the logging owner which messages should appear remotely and which should remain outside the forwarded scope. Do not describe an intentional priority exclusion as a transport failure.

Review each receiver’s actual observations independently. If a second receiver is part of the requirement, require evidence for it rather than accepting the first receiver’s search result as coverage for both. Keep any resilience or interruption exercise in a separate approved plan with its own expected behavior; the configuration screen alone should not supply that expectation.

Review the proposed receiver names with the team that searches them during incidents. Use the same harmless event identifier in each authorized search, and preserve a missing second-receiver result as a separate finding rather than substituting the first receiver’s screenshot.

Verification and evidence

Proposed verification: compare the approved local test observations with the records found at each configured receiver. Record input identifier, priority, time, selected threshold and receiver result. Investigate missing included messages and unexpected excluded messages before changing the threshold merely to make the test appear successful.

For the selected transport, perform the relevant approved connection and trust checks without exposing private keys. Retain the receiver worksheets, redacted configuration and actual search evidence. Have the incident-response owner confirm that the agreed message population can be found. Keep this acceptance separate from a claim about buffering or recovery during a future collector interruption.

Official references

• TrueNAS — Managing System Logging — official product documentation; confirm the installed release and configuration.

Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.