🧪 UniFi "Send Test Event" looks successful—but won't send if System category is deselected

TL;DR: The UniFi UI's Send Test Event (Settings ⚙️ → Control Plane → Integrations) only works if the System category is selected in Categories. The UI still shows "Event Sent ✅" even when System is deselected—so nothing appears in your logs. Suggestion for Ubiquiti: make test events use a hidden Test category that can't be turned off, so the button always validates the end-to-end pipeline.

On the Settings ⚙️ → Control Plane → Integrations page of the UniFi UI there's a very handy Send Test Event button. When you click it (1️⃣ in the screenshot), a little tile slides down saying Event Sent with a green check mark (2️⃣). Great! Except… in the situation shown below, no test event is actually shipped—even though the UI says it was.

What's going on?

In the Categories section (3️⃣), there are fourteen different event categories you can select. Test events belong to the System category. If System is unchecked, UniFi still shows "Event Sent" in the UI—but nothing lands in your log receiver.

Evidence: test events are System

Here's a sample test event you'll see when it works, clearly indicating it's a system event:

Aug 27 17:24:47 udmpro CEF:0|Ubiquiti|UniFi OS|4.3.6|system|0|msg=Test log

Fix

  1. Go to Settings ⚙️ → Control Plane → Integrations.
  2. In Categories, make sure System is selected.
  3. Click Send Test Event again and confirm it now arrives at your log shipper/receiver.

Why this matters

I pity the poor UniFi admin who—perhaps for noise reduction—deselected System, then clicked Send Test Event, saw "Event Sent" ✅, and waited for logs that never came. That "success" message can send you chasing the wrong problem (parsers, network, SIEM inputs) when the real culprit is simply an excluded category.

Suggestion for Ubiquiti

Please consider a dedicated, non-toggleable Test category for the Send Test Event button. That way the button always validates the end-to-end pipeline. If a test event doesn't arrive, we immediately know to troubleshoot the shipper/receiver path—not category selection.

Comments

Post a Comment

Popular posts from this blog

🛠️ UniFi Network Application 9.4.17: CEF Syslog Timestamp Fixes

TL;DR: UniFi Network Application 9.4.17 brings two welcome changes for CEF events in syslog: their syslog timestamp now follows the local time zone (matching other UniFi events), and a new field UNIFIutcTime provides a proper UTC timestamp with time zone information. UniFi Network Application 9.4.17 is now a release candidate . As usual, the release notes don't say much about syslog activity logging, but there are some very welcome improvements. In my earlier post, 🕰️ Inconsistent Time Zones in UniFi Logs , I showed that most UniFi events used the local time zone while CEF events used UTC . That mismatch could break event correlation in log management systems and SIEMs—if you weren't aware of it and didn't handle the difference. What has changed in 9.4.17 (for CEF events) Syslog timestamps now align with local time. CEF events' syslog timestamp uses the local time zone , matching other UniFi event types. This is good news for consistency,...
Read more

🕰️ Inconsistent Time Zones in UniFi Logs

Image
TL;DR: UniFi logs from different processes don't use a consistent time zone. CEF events are timestamped in UTC, while other logs use the local device time (which may include daylight savings). This inconsistency causes confusion and breaks correlation in SIEMs and log management systems. Ubiquiti should standardise on UTC for all events. Looking at the logs from my UniFi Dream Machine Pro, it's clear that many different processes are responsible for providing all the awesome functionality it offers. In my previous post, I pointed out that, in this day and age, timestamps should include time zone information . But at the very least, you'd expect that all processes on the same device use the same time zone, right? Nope. Take a look at this screenshot from my log management system: First, you see an ingesttimestamp —the time when the log management system received the event. Then you see the raw event as sent by the UniFi Dream Machine. Look at the highlighte...
Read more
🧩 CEF, But Not Quite: UniFi OS Events Break the Format TL;DR: UniFi devices generate two types of CEF events—one from "UniFi Network" and one from "UniFi OS". Only the "UniFi Network" events are properly formatted. "UniFi OS" events are malformed, missing required fields, and cannot be parsed without custom workarounds. If you're relying on CEF parsers, expect frustration. Ubiquiti should fix these broken events. In my previous post, I wrote that UniFi devices can generate CEF events for both UniFi OS and UniFi Network . I need to clarify that statement. Because only one of those event types is correctly formatted as CEF. The other? Parsers won’t even touch it. What CEF is supposed to look like To make sense of this, let’s first recap what a CEF event is supposed to look like. The official documentation for the format is here: 👉 Micro Focus CEF Implementation Standard According to the spec, a typical CEF header looks l...
Read more