# Is there a topic that captures ACL logs or is there a way to forward them to an external system?

**URL:** <https://community.solace.com/t/is-there-a-topic-that-captures-acl-logs-or-is-there-a-way-to-forward-them-to-an-external-system/1769>\
**Category:** Training, Tips and Tricks\
**Tags:** logs\
**Created:** [September 21, 2023, 1:37pm UTC](https://community.solace.com/t/is-there-a-topic-that-captures-acl-logs-or-is-there-a-way-to-forward-them-to-an-external-system/1769 "2023-09-21T13:37:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rjohnson](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rjohnson](https://community.solace.com/u/rjohnson)\
**Post date:** [September 21, 2023, 1:37pm UTC](https://community.solace.com/t/is-there-a-topic-that-captures-acl-logs-or-is-there-a-way-to-forward-them-to-an-external-system/1769/1 "2023-09-21T13:37:19Z")

</div>

I’m working on a logging strategy document, and I’m trying to determine if there’s a way to capture ACL logs from a Solace Cloud environment and forward them to an external system. I’m open to using any method REST Delivery Point, syslog forwarding, etc.

I’m aware that system, client and vpn logs are sent to a topic #LOG, but that doesn’t seem to include ACL logs.

Thanks!

---

<div class="post-metadata">

**Author:** ![marc](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/marc/32/2191_2.png) [@marc](https://community.solace.com/u/marc)\
**Post date:** [September 21, 2023, 5:23pm UTC](https://community.solace.com/t/is-there-a-topic-that-captures-acl-logs-or-is-there-a-way-to-forward-them-to-an-external-system/1769/2 "2023-09-21T17:23:24Z")

</div>

Hi @rjohnson ,

I think the logs you are looking for are likely in the client logs. You can find the list of syslog events here:

> **[SolOS-TR Message Bus Management Syslog Events](https://docs.solace.com/Admin-Ref/Solace-PubSub-Event-Reference/event_ref_boiler.html)**

![image.png](https://canada1.discourse-cdn.com/solace/original/1X/187923743032b5f2ac69bc08a38f8db04d532197.png)

You can also see how you can subscribe to only the events you want to receive when listening to these over the message bus on this page:

> **[Subscribing to Message Bus Events](https://docs.solace.com/Monitoring/Subscribing-to-MBus-Events.htm)**

Hope that helps!

---

<div class="post-metadata">

**Author:** ![rjohnson](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rjohnson](https://community.solace.com/u/rjohnson)\
**Post date:** [September 21, 2023, 8:23pm UTC](https://community.solace.com/t/is-there-a-topic-that-captures-acl-logs-or-is-there-a-way-to-forward-them-to-an-external-system/1769/3 "2023-09-21T20:23:36Z")

</div>

@marc - Thank you for the comment. I didn’t see those nested in the system logs. I was also thinking that the acl logs created an event for both allow and denial activities, but upon looking close at this page [Configuring ACL Profiles](https://docs.solace.com/Security/Managing-Access-Control-Lists.htm#Viewing-ACL-Logs) it looks like it is just denials.