The Cisco Umbrella Virtual Appliance version 3.1.x and above support logging to a remote syslog server.
The following messages can be logged to syslog through this feature:
- VA upgrades and reboots
- Logins to the VA and any config commands executed on the VA
- Requests for internal domains that are forwarded by the VA to local DNS servers. This can provide visibility into the source of these DNS requests for internal domains
Instructions for configuring remote logging on the VA are documented at https://docs.umbrella.com/deployment-umbrella/docs/appendix-e-other-configurations#syslog