GUIDE — 2026-08-06

How to receive UniFi syslog on your Mac

Complete step-by-step setup for forwarding syslog messages from a UniFi Dream Machine, Cloud Gateway Ultra, UniFi Cloud Key, or UniFi OS Console to a native macOS receiver. No cloud service, no third-party account, just your Mac.

Why forward UniFi logs to your Mac?

UniFi's built-in Events tab is fine for a quick glance, but it retains only a small rolling window and cannot be searched, exported, or alerted on. If you have ever had a device drop off the network at 3am and wanted to know exactly which port flapped or which client failed to associate, you already know the pain of a UniFi console with no historical log depth.

Sending syslog to your Mac gives you:

Persistent local storage of every event, on your own disk
Instant search across weeks or months of history
Alerts (sound, email) on specific keywords like "failed", "wan down", "kernel"
No cloud vendor storing your network activity

What you need

Any UniFi OS device (UDM, UDM Pro, UDM SE, UCG Ultra, UCG Max, UCG Fiber, UCK G2, UCK+, or UDR) running recent firmware
A Mac on the same network (or at least reachable at a stable IP)
A syslog receiver on the Mac — SyslogWatch is what we made specifically for this. Free tier is enough for most homelab setups.

Step 1 — Note your Mac's IP address

Open System Settings → Network on the Mac. Select your active interface (usually Wi-Fi or Ethernet). Note the IPv4 address, for example 192.168.1.42.

For reliable syslog reception, give your Mac a DHCP reservation in the UniFi controller so this IP does not change:

UniFi controller → Clients → find your Mac
Settings gear → Fixed IP Address → toggle on
Set the fixed IP → Apply

Step 2 — Install SyslogWatch on the Mac

Get it from the Mac App Store. Free tier includes UDP + TCP receiving, RFC 3164 and RFC 5424 parsing, filtering, and 7-day archive — sufficient for a home UniFi network.

Launch the app. By default it listens on UDP + TCP port 1514 (a non-privileged port, no admin password needed). You can leave this as is.

Step 3 — Configure UniFi to forward syslog

UniFi's syslog forwarding is on the controller, not on individual APs or switches. Setting it once forwards everything managed by the controller.

For UniFi Network (v7+ / v8+ / v9+)

Open the UniFi Network controller in your browser
Go to Settings → System → Application Configuration
Scroll to Remote Logging
Toggle Enable Remote Syslog Server on
Enter:
- Host: your Mac's IP (from Step 1)
- Port: 1514
Toggle Include Debug Messages off unless you want a firehose
Toggle Log All Contents on if you want client roam events and full DHCP lifecycle
Click Apply Changes

For UniFi Protect, Access, or Talk (separate applications)

Each application has its own Remote Logging setting under its own Settings pane. Point all of them at the same Mac + port 1514 — SyslogWatch will tag each message with the sending host so you can filter later.

Step 4 — Verify messages are arriving

Back in SyslogWatch, you should see events start flowing within a few seconds. If nothing appears in 60 seconds:

Confirm the Mac's macOS firewall is not blocking port 1514. System Settings → Network → Firewall → Options → make sure SyslogWatch is allowed for incoming connections.
Confirm the Mac and UniFi device are on the same subnet, or that routing is in place between subnets.
Try tcpdump -i any port 1514 in Terminal to see if packets are reaching the Mac at all.

Step 5 — Create useful filters

Once messages are streaming, the filter box lets you narrow to what matters. Some UniFi-specific filters worth saving:

failed — failed logins, failed handshakes, DHCP failures
wan — WAN link state changes
kernel — deeper kernel events, useful when debugging drops
hostapd — Wi-Fi association events
DFS — 5 GHz DFS channel changes (useful when Wi-Fi drops for a minute at random)

Step 6 — Set up alerts (Pro)

If you upgrade to SyslogWatch Pro, you can create rules like:

Match "failed password" three times within 60 seconds → sound alert + email
Match "wan down" → sound alert + email
Match "DFS" more than five times per day → email

Email delivery goes through your own SMTP server (Gmail, Fastmail, iCloud, or your own postfix). SyslogWatch does not have a mail relay of its own — a deliberate privacy decision.

Common UniFi log patterns to know

Pattern	Meaning
`Client disconnected`	Wi-Fi client left the network
`Client roamed to`	Client moved between APs
`Link is Up / Link is Down`	Switch port state change
`Wireguard peer connected`	VPN client came online
`THREAT: signature`	IDS/IPS event (if enabled)
`Adopted by controller`	A device was newly adopted

Troubleshooting

Getting messages from only the UDM but not from APs? That is normal — APs report to the UDM, and the UDM forwards to your syslog server. Individual APs do not typically speak syslog directly.

Timestamps look wrong? Check the UDM's timezone under Settings → System → Date and Time. UniFi syslog uses the controller's local time.

Getting too much noise? Turn off "Include Debug Messages" in the Remote Logging settings.

What's next

Once UniFi is flowing, the same Mac can also receive from your NAS, firewall, and Linux boxes on the same port. See our pfSense → Mac guide and Synology → Mac guide.

Or grab SyslogWatch on the Mac App Store and get started — free tier, no cloud account, 30-minute setup.