Jetico Central Management (JCM) supports syslog message generation in accordance with RFC 3164 (The BSD Syslog Protocol).

When enabled, JCM records all messages generated by JCM components and client software in a file in RFC 3164 syslog format. These records can be collected and processed by external log management or SIEM systems for centralized monitoring, auditing, and analysis.

Note: JCM generates syslog-formatted messages in a file. It does not natively transmit syslog messages over the network to a remote syslog server.


Syslog generation can be activated and deactivated via the configuration file "application.properties". A restart of the JCM service / host PC is required to apply the changes.

  1. Activating / deactivating syslog
    The jcm.syslog.enable parameter controls the syslog generation:
      • jcm.syslog.enable: true - syslog generation enabled
      • jcm.syslog.enable: false - syslog generation disabled

By default, the parameter is set to false.


  1. Configuring the syslog file path
    The location and name of the syslog file are defined by the jcm.syslog.path parameter. Supported formats:
      • File name only: jcm.syslog.path: jcm_syslog.log (the file is created in the JCM home directory)
      • Relative path: jcm.syslog.path: logs\\jcm_syslog.log (the logs folder and the file within it are created in the JCM home directory)
      • Absolute path: jcm.syslog.path: C:\\logs\\jcm_syslog.log (the file is created at the specified absolute path)

  2. Events recorded in the syslog file
    The syslog file records the following types of events generated by JCM components and client software:
      • Activity log
      • Deployment log
      • BCWipe log
      • BCVE log
      • Data Shelter log
      • Search log (only search results)

  1. Syslog message format (RFC 3164)
    Each syslog entry follows the RFC 3164 structure: <PRI>Timestamp Hostname Tag: Message
      • PRI (priority):
        A one-, two-, or three-digit decimal number calculated as: PRI = (facility × 8) + severity
        • Facility identifies the originating subsystem
        • Severity indicates the importance level of the event (e.g., informational, warning, error)

               A complete table of facility and severity values is available in: RFC 3164, Section 4.1.1

      • Timestamp: the time when the event occurred (e.g., Jan 01 15:20:36)
      • Hostname: the hostname or IP address of the JCM client that generated the message
      • Tag: identifies the JCM component that produced the event
      • Message: the event description in human-readable form

Example: <140>Jan 01 01:06:02 192.168.188.220 bcvolume: 2 unsuccessful attempts to enter password for boot volume have been detected.

      • 140 - calculated PRI value: 17*8 + 4
        • Facility = 17 (local1)
        • Severity = 4 (Warning: warning conditions)
      • Jan 01 01:06:02 - timestamp of the event
      • 192.168.188.220 - hostname or IP address of the JCM client
      • bcvolume - component tag identifying the JCM module that generated the event
      • 2 unsuccessful attempts to enter password for boot volume have been detected. - human-readable event description