---
id: vmware-airwatch-integration
title: VMware AirWatch Integration for Sumo Logic
sidebar_label: VMware AirWatch
description: This page shows you how to configure AirWatch cloud syslog events for use with Sumo Logic.
slug: /help/docs/send-data/collect-from-other-data-sources/vmware-airwatch-integration/
canonical: https://www.sumologic.com/help/docs/send-data/collect-from-other-data-sources/vmware-airwatch-integration/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

[VMware AirWatch](https://www.air-watch.com) is an enterprise mobility management (EMM) software and standalone management systems for content, applications and email. Sumo Logic integrates with VMware AirWatch to provide visibility for monitoring enterprise mobility management in your deployment. The unified digital workspace platform simplifies and secures app access and IT management throughout your environment.

VMware Airwatch is an integral part of [Workspace ONE](https://www.air-watch.com/why-workspace-one-airwatch/), an any app, any device experience that provides 1-click workflows with a virtual assistant for an intuitive and engaging experience.

## Collecting AirWatch Events

AirWatch supports sending events to syslog. For Sumo Logic to receive AirWatch events, you must create a cloud syslog in Sumo Logic. This section shows you how to do the following:

1. Configure cloud syslog in Sumo Logic.
1. Integrate AirWatch and configure syslog.

## Step 1. Configure cloud syslog in Sumo Logic

To configure cloud syslog in Sumo Logic, follow the instructions on [this page](/docs/send-data/hosted-collectors/cloud-syslog-source).

After a cloud syslog is configured, the following values are available:

 * Token 
 * Host 
 * TCP TLS Port

These three values–shown on the Cloud Syslog Source dialog–are used to configure syslog integration in AirWatch. 

:::note
During syslog configuration in AirWatch, you can choose to send Console events, Device events, or both. Any events generated by the AirWatch Console are sent to Sumo Logic.
:::

## Step 2. Integrate AirWatch and configure syslog

This section shows you how to integrate AirWatch with Sumo Logic and configure syslog. During the syslog configuration process you can specify the events to be sent to Sumo Logic. You can choose to send Console events, Device events, or both.

To enable integration and configure syslog, do the following:

1. Log in to your AirWatch account.
1. Navigate to **Monitor > Reports and Analytics > Events > Syslog**.

    <img src={useBaseUrl('img/send-data/Syslog_dialog.png')} alt="AirWatch Syslog dialog" style={{border: '1px solid gray'}} width="300" />

1. Select **Enabled** on the Syslog dialog.

    <img src={useBaseUrl('img/send-data/Syslog_dialog_options.png')} alt="Enabled on the Syslog dialog" style={{border: '1px solid gray'}} width="500" />

1. Specify the following options in the Syslog dialog:

    | Setting | Description | Sumo Logic Specific Value |
    |:--|:--|:--|
    | Syslog Integration | Enable/Disable | Enable |
    | Host Name | Host Name of Cloud Syslog | Host Name of the Sumo Logic Cloud Syslog:<br/>`syslog.collection.us1.sumologic.com` |
    | Protocol | UDP, TCP, Secure TCP | A secure TCP is required for Sumo Logic  |
    | Port | Port number | 6514 |
    | Syslog Facility | Roughly suggests from what part of a system a message originated, and can help distinguish different classes of messages. | Optional, or as required |
    | Message Tag | Enter a descriptive tag to identify events from the AirWatch Console in the Message Tag field. | Optional, or as required |
    | Message Content | Enter the data to include in the transmission in the Message Content field.<br/>Note: Paste the Sumo Logic Token in the message field as highlighted in next column. | AirWatch Syslog Details are as follows:<br/>Event Type: `{EventType}`<br/>Event: `{Event}`<br/>User: `{User}`<br/>Event Source: `{EventSource}`<br/>Event Module: `{EventModule}`<br/>Event Category: `{EventCategory}`<br/>Event Data: `{EventData} 7SarExampleSumoLogicToken+57f7ZDzI4aDN29uOy0vPj6x9z6tkwH6KBtS@41123` |

1. Click the **Advanced** tab, and configure the following settings.

   | Setting | Description |
   |:--|:--|
   | **Console Events** | Select whether to enable or disable the reporting of Console events. |
   | **Select Console Events to Send to Syslog** | For each subheading, select the specific events that you want to trigger a message to syslog. |
   | **Device Events** | Select whether to enable or disable the reporting of Device events. |
   | **Select Device Events to Send to Syslog**  | For each subheading, select the specific events that you want to trigger a message to syslog. |

1. Click **Save**, and then click **Test Connection** to ensure you have successful communication between the AirWatch Console and Sumo Logic. For more information, see the following AirWatch [documentation](https://docs.vmware.com/en/VMware-AirWatch/9.3/vmware-airwatch-guides-93/GUID-AW93-Configure_Syslog.html).

After a successful integration, the events start flowing into Sumo Logic.