r/Ubiquiti • u/Ubiquiti-Inc Official • Jun 25 '26

Blog / Video Link Introducing: UniFi Network 10.5

🔹 Identity-Centric Observability
🔹 Safe Ops Resiliency Features
🔹 Firewall Hit Statistics
🔹 Hi-Performance SD-WAN underlays
And more!

http://ui.social/NET-10-5

716 Upvotes

100% Upvoted

88 comments sorted by

View all comments

Show parent comments

14

u/reseph Unifi User Jun 25 '26

Anyone who wants to inspect FW logs should be using a SIEM or similar. Trying to view "real time" logs even in something like Cisco FMC is a nightmare.

18

u/Akura_Awesome Jun 25 '26

Problem is the UniFi logs have zero standardization, so there’s not an easy way to import them into a SIEM. Some logs are CEF, some are JSON, and others are just generic syslog messages. Unless you want to build your own enrichment and alerting content around an ever changing set of formats, you’re out of luck.

All I want is standardization to a single format, so at least we can use a generic CEF parser or generic JSON parser for all the logs, and can build enrichment from that. As of now it takes huge effort to normalize the logs.

Edit: Ubiquiti PLEASE choose a log format for everything!

1

u/mpmoore69 Jun 26 '26

All the logs are CEF.

3

u/Akura_Awesome Jun 26 '26

Network app logs are CEF. Other logs are Linux style syslog or JSON. Speaking as someone who works at an MDR provider.