Introducing Syslog Receiver – A New HACS Integration for Ingesting Syslog into Home Assistant

:mega: I’m excited to share my first HACS integration: Syslog Receiver!

The main reason why this project was created is that my QNAP NAS HA integration is not able to provide detailed warning messages, only that something is wrong, but it cannot communicate to HA what exactly it is. This project was created for this, when I saw that there was no such solution yet and that any device that can send syslog can be integrated into HA. I hope you will find it useful too.

With this custom integration, you can:

  • Listen for syslog messages over UDP, TCP, or encrypted TCP (TLS)
  • Filter incoming logs by source IP and severity level
  • Fire Home Assistant events (syslog_receiver_message) for automations
  • Optionally expose the last‐message sensor for each listener
  • Configure everything via the UI—no YAML required

:wrench: Quick Start via HACS

  1. In HACS, search for Syslog Receiver, or click on the “Add Repository” button and add repository URL https://github.com/zollak/homeassistant-syslog-receiver.
  2. Download, then Restart Home Assistant.

:gear: Configure Your Listener
Go to Settings → Devices & Services → Add Integration and select Syslog Receiver. You’ll be prompted to set:

  • Instance Name (e.g. “Syslog Receiver UDP”)
  • Host (e.g. 0.0.0.0 or a specific IP from any HA interface where you would listen for the incoming syslog packets)
  • Port (e.g. 514 for syslog packets or you can set custom port)
  • Protocol: UDP, TCP, or TCP+TLS
  • TLS certfile/keyfile (if using encrypted syslog)
  • Allowed IPs (comma-separated whitelist)
  • Minimum Severity threshold
  • Enable Sensor toggle (to create a sensor.syslog_receiver_<id>)

:dart: Use Cases

  • Trigger automations on specific log patterns or error levels
  • Dashboard view: show the latest syslog entry via the sensor
  • Multi-instance: run separate listeners for different protocols

:white_check_mark: 1. Automation example: notify on critical syslog errors

trigger:
  platform: event
  event_type: syslog_receiver_message
condition:
  condition: template
  value_template: "{{ trigger.event.data.severity <= 2 }}"
action:
  service: notify.mobile_app
  data:
    title: "[SYSLOG ERROR] {{ trigger.event.data.source_ip }}"
    message: "{{ trigger.event.data.message }}"

:white_check_mark: 2. Log all messages from a specific device to file

alias: "Log NAS syslog to file"
trigger:
  platform: event
  event_type: syslog_receiver_message
condition:
  condition: template
  value_template: "{{ trigger.event.data.source_ip == '10.10.10.50' }}"
action:
  - service: system_log.write
    data:
      level: info
      message: "NAS syslog: {{ trigger.event.data.message }}"

:white_check_mark: 3. Send a persistent notification for login attempts

alias: "Notify on SSH login attempt"
trigger:
  platform: event
  event_type: syslog_receiver_message
condition:
  - condition: template
    value_template: >-
      "sshd" in trigger.event.data.message and (
      "Accepted password" in trigger.event.data.message or
      "Accepted publickey" in trigger.event.data.message)
action:
  - service: persistent_notification.create
    data:
      title: "SSH Login Detected"
      message: >-
        From {{ trigger.event.data.source_ip }}:
        {{ trigger.event.data.message }}

:white_check_mark: 4. Create a scene trigger for router firewall rule changes

alias: "Firewall Rule Changed"
trigger:
  platform: event
  event_type: syslog_receiver_message
condition:
  condition: template
  value_template: >
    "filter rule changed" in trigger.event.data.message
action:
  - service: script.turn_on
    target:
      entity_id: script.notify_admin_change

:white_check_mark: 5. Turn on a light if a physical door sensor logs a state

alias: "Trigger light on syslog motion"
trigger:
  platform: event
  event_type: syslog_receiver_message
condition:
  condition: template
  value_template: >
    "Motion detected" in trigger.event.data.message
    and trigger.event.data.source_ip == "192.168.1.99"
action:
  - service: light.turn_on
    target:
      entity_id: light.garden_spotlight

:white_check_mark: 6. Exclude debug messages from database (via sensor)

If you’re using the optional sensor, you may want to exclude low-severity updates in recorder: config:

recorder:
  exclude:
    entity_globs:
      - sensor.syslog_receiver_*
  # or keep it but purge quickly:
  purge_keep_days: 3

:books: Learn More & Contribute

I’d love your feedback, bug reports, or pull requests! Let me know how you’re using it in your setups. :pray:t3:

4 Likes

IPv6 support was suggested by @ivanfmartinez, which I already published in beta, so Syslog Receiver can now receive over IPv6 (beta4). I welcome any feedback, as I currently do not have any device configured to communicate over IPv6.

:new: New in v1.2.1 – Configurable Message Encoding

This release adds support for customizable syslog message encoding, allowing better compatibility with a wider range of devices and platforms. Users can now select from common encodings like UTF-8, Latin1, Windows-1252, and others directly in the integration’s configuration UI. For advanced cases, a "Other..." option is also available, letting you enter a custom encoding manually (e.g., ISO-8859-2, cp850, etc.).

The selected encoding is saved per instance and automatically applied during message decoding, ensuring correct character interpretation from diverse syslog sources. Thanks to @copydog for the original idea and reference code in Issue #4.