Separate reliable collection from storage
A traditional syslog server combines UDP ingress, disk capacity, log rotation, scaling, retention, and alerting in one failure-prone host or cluster. Proxylity handles the UDP and WireGuard ingress while AWS services receive, retain, and monitor the messages in your account.
Site gateways → WireGuard-protected UDP → Proxylity listener
Live path → CloudWatch Logs | Archive path → Firehose → S3 Object Lock
Production controls are part of the example
Encrypted multi-site ingress
Each site gateway authenticates with its own WireGuard public key before syslog leaves the source network.
Live and archive fan-out
One listener delivers messages to CloudWatch Logs for immediate queries and through Firehose to S3 for durable storage.
Retention and immutability
Customer-managed KMS keys protect data at rest, while S3 Object Lock in governance mode prevents archive overwrite or deletion during retention.
Operational alarms
Metric filters detect high-severity messages and pipeline silence, with notifications delivered through SNS.
One architecture, isolated by region and policy
Deploy separate stacks when logs must remain in a specific AWS region or when compliance tiers require different keys, retention periods, and access policies. New sites are added as WireGuard peers through CloudFormation without changing the ingestion architecture.
The source hostname remains in the RFC 5424 message, so application-layer attribution is preserved after traffic passes through the gateway. Firehose buffers archive delivery; CloudWatch Logs is the live investigation path.
Deploy and verify the pipeline
The example includes the CloudFormation template, WireGuard gateway configuration, stack outputs, live CloudWatch queries, S3 archive checks, and destination error inspection. Network gateways still require split-tunnel and syslog-forwarding configuration; the AWS processing path itself requires no custom runtime code.
View source and deployment steps →
Read the architecture story →
Related use cases
Modernize RADIUS | Inspect UDP protocols live | Apply policy to DNS