GitHub Enterprise uses rsyslog to forward system and application logs to the server you specify in the Management Console settings.
Any log collection system that supports syslog-style log streams is supported (e.g., logstash and splunk).
Enabling log forwarding
- On the Management Console settings page, in the left sidebar, click Monitoring.
 - Select Enable log forwarding.
 - In the Server address field, type the address of the server to which you want to forward logs.
 - In the Protocol drop-down menu, select the protocol to use to communicate with the log server.
 
Warning: If you use the TCP or RELP protocols, a misconfigured or unreachable log server may cause your GitHub Enterprise appliance to become unresponsive. We recommend using UDP and testing changes in a non-production environment first.
Troubleshooting
If you run into issues with log forwarding, contact GitHub Enterprise support and attach the output file from http(s)://[hostname]/setup/diagnostics to your email.