anchor.diff:  
   ## <a id='create'></a>Step 2: Create a User-provided Service Instance ##
   
  -Create a user-provided service instance using the `create-user-provided-service` command with the `-l` option and the syslog URL you obtained earlier as the example below shows.
  -The `-l` option configures the syslog drain.
  +Create a user-provided service instance using the [cf CLI](../installcf/) `create-user-provided-service` command with the `-l` flag and the syslog URL that you obtained in [Step 1: Configure the Log Management Service](#config).
  +The `-l` flag configures the syslog drain.
   
   <pre class="terminal">
  -cf create-user-provided-service SERVICE-INSTANCE -l syslog://example.com
  +$ cf create-user-provided-service SERVICE-INSTANCE -l SYSLOG-URL
   </pre>
   
   Refer to the [cf create-user-provided-service Command](./user-provided.html#user-cups) section of the _User-Provided Service Instances_ topic for more information.
  
positive.code: 
  You have two options for binding the service instance to an application:
  
  * Use `cf push` with a manifest. The services block in the manifest must specify the service instance that you want to bind.
  * Use `cf bind-service`. After a short delay, logs begin to flow automatically.
  
  See [Binding User-Provided Service Instances to Applications](user-provided.html#cups-example).
  
  ## <a id='verify'></a>Step 4: Verify that Logs are Draining Correctly ##
  
  To verify that logs are draining correctly to a third-party log management service:
  
  1. Take actions that you believe should produce log messages, such as making requests of your app.
  
  1. Compare the logs you see in the CLI against those that the service shows you.
  
  For example, if your application serves web pages, you can send HTTP requests to the application.
  In Cloud Foundry, these generate Router log messages, which you can view in the CLI.
  The third-party logging service should display corresponding messages.
  
  <p class="note"><strong>Note</strong>: For security reasons, Cloud Foundry applications do not respond to ping. Therefore, you cannot use ping to generate log entries.</p>
  
negative.code: 
  _This page assumes you are using cf CLI v6._
  
  This topic describes how to use a third-party log management service to drain logs from your Cloud Foundry installation.
  
  Logs record activity in all instances of your applications and in other components of your Cloud Foundry installation. For example, when a Cloud Foundry Router routes an HTTP request to an app, the Router records that event in the application log stream.
  
  Cloud Foundry [Doppler](../deploy-apps/streaming-logs.html) consolidates log information from your application and from Cloud Foundry system components. By default, Doppler streams logs to your terminal. If you want to persist more than the limited amount of logging information that Doppler can buffer, you can drain logs to a third-party log management service such as Logentries, Logstash, Papertrail, or Splunk.
  
  Complete the following procedure to use a third-party log management service.
  
  ## <a id='config'></a>Step 1: Configure the Log Management Service
  
  Set up a communication channel between the log management service and your Cloud Foundry deployment as follows:
  
  1. Obtain the <%=vars.external_ips%> that <%=vars.admin%> assigns to outbound traffic.
  
  1. Provide these IP addresses to the log management service. The specific steps to configure
  a third-party log management service depend on the service. See the [Configuring Selected Third-Party Log Management Services](log-management-thirdparty-svc.html) topic for more information.
  
  1. Whitelist these IP addresses to ensure unrestricted log routing to your log management service.
  
  1. Record the syslog URL provided by the third-party service. Third-party services
  typically provide a syslog URL to use as an endpoint for incoming log data. You use this syslog URL in [Step 2: Create a User-provided Service Instance](#create).
  <br><br>
      Cloud Foundry uses the syslog URL to route messages to the service.
      The syslog URL has a scheme of `syslog`, `syslog-tls`, or `https`, and can
      include a port number.
  