anchor.diff:  
   Details about each of these steps follow.
   
  +### <a id='cli'></a>Observing the logs for your application ###
  +
  +It's a good idea to become familiar with the log messages your application and relevant system components generate.
  +[Use the CLI](../deploy-apps/streaming-logs.html#view) to explore what kinds of messages are generated by various application behaviors.
  +Then you are better prepared to understand what you see in a third-party log management service.
  +See [Viewing Logs in the Command Line Interface](../deploy-apps/streaming-logs.html#view).
  +
   ### <a id='config'></a>Configuring the log management service to treat your application as a source of data ###
   
  -Typically, you must configure a third-party log management service to accept traffic from your Cloud Foundry environment.
  +Typically, you must configure a third-party log management service to accept traffic from your Cloud Foundry.
   Depending on the service provider, you may need the following information:
   
  -* The external IP addresses <%=vars.admin%> assigns to outbound traffic<%=vars.log_drain%>
  -
  -    **Note**: You must whitelist all of these IP addresses. Allowing traffic from a subset of the external IP addresses assigned to outbound traffic restricts the logs that are available to third party services.
  +* The external IP addresses of the two NAT boxes from which Cloud Foundry will send log traffic to the service.
  +Ask your Cloud Foundry administrator for these IP addresses.
  +(NAT boxes are systems responsible for Network Address Translation, not to be confused with the NATS messaging protocol.)
   
   * The syslog URL, a special URL that the service typically makes available as an endpoint for incoming log data.
   Cloud Foundry uses the syslog URL to route messages to the service.
  -The syslog URL has a scheme of `syslog`, `syslog-tls`, or `https` and can include a port number.
  +The syslog URL has a scheme of `syslog` or `syslog-tls` and includes a port number.
   For example:
   
    `syslog://logs.example.com:1234`
   
   TLS support is described in [RFC 5425](http://tools.ietf.org/html/rfc5425).
   
  -`https` protocol is available as of release v158.
  -
   ### <a id='create'></a>Creating a user-provided service instance with a syslog drain ###
   
  -Create a user-provided service instance using the `create-user-provided-service` command with the `-l` option and the syslog URL you obtained earlier.
  +Create a user-provided service instance using the `cups` command with the `-l` option and the syslog URL you obtained earlier.
   The `-l` option configures the syslog drain.
  -Refer to the [User-Provided Services](./user-provided.html#user-cups) topic for more information.
  +See [User-Provided Services] (./user-provided.html#user-cups).
   
   ### <a id='bind'></a>Binding the service instance to the application ###
   
  
positive.code: ---
  title: Using Third-Party Log Management Services
  ---
  
  _This page assumes that you are using cf v6._
  
  Logs tell you both what your app does and what the system does with your app.
  For any one application, logs come from each instance of the app and also from Cloud Foundry system components.
  For example, when a Cloud Foundry Router routes an HTTP request to an app, the Router records that event in the application log stream.
  
  Cloud Foundry keeps a limited amount of logging information in memory.
  When you want to persist more log information than this, you must drain logs to a third-party log management service.
  You can then use the third-party service to analyze the logs.
  For example, you could produce metrics for application response times or error rates.
  
  <<<<<<< HEAD
  Providers whose log management products or services have been verified to work with syslog output include [Logentries](https://logentries.com/), [logstash](http://logstash.net/), [Papertrail](https://papertrailapp.com/), and [Splunk](http://www.splunk.com/).
  =======
  Providers whose log management products or services work with Cloud Foundry include Logentries, logstash, Papertrail, and Splunk. You will need to [setup an appropriate connection with these services for use with Cloud Foundry](log-management-thirdparty-svc.html).
  >>>>>>> b3a428f336abf647c435bdac8fb883aac4b4846e
  
  You can think of the relationship between Cloud Foundry and the third-party logging service in terms of source, sink, and drain:
  
  
negative.code: ## <a id='loggregator'></a>Loggregator ##
  
  The Loggregator component of Cloud Foundry consolidates the logs of all actions that directly affect the app.
  Loggregator keeps a limited amount of logging information in memory.
  Eventually the newest logging information replaces the oldest.
  If forced to restart, Loggregator retains no logging information from before the restart.
  
  When sending logs to third-party services, Loggregator formats the data according to the *Syslog Protocol* defined in [RFC 5424](http://tools.ietf.org/html/rfc5424).
  Third-Party Log Management Software is defined in [RFC 6587](http://tools.ietf.org/html/rfc6587).
  
  In the Command Line Interface (CLI), you can view the entire Loggregator output or filter it to select a subset of logging information.
  Logs viewed in the CLI are not in syslog format.
  
  ## <a id='use'></a>Draining Logs to a Third-Party Log Management Service ##
  
  To drain logs from your application and relevant Cloud Foundry components to a third-party log management service, complete this procedure:
  
  1. Observe the logs for your application.
  
  1. Configure the log management service to treat your application as a source of data.
  
  