---
title: "Proxmox Proxmox Integration"
slug: "proxmox"
updated: 2026-11-02T10:27:25Z
published: 2026-11-02T10:27:25Z
canonical: "docs.hunters.ai/proxmox"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxmox Proxmox Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Proxmox VE Host Syslog (System/Auth Events) |  | ✅ | ✅ | ✅ | proxmox_host_syslog | JSON | S3 |

## Overview

Proxmox VE (Virtual Environment) is an open-source server virtualization platform that manages KVM virtual machines and LXC containers across a cluster of hosts, built on a standard Debian-based Linux operating system. This integration ingests the host-level syslog/journald stream forwarded from Proxmox nodes, wrapped in a JSON envelope that preserves the original syslog priority, timestamp, hostname, and process name inside a free-text message field. While most events reflect generic Linux OS activity — systemd service lifecycle events, sshd-session authentication and disconnection events, and PAM session open/close notifications — a smaller subset surfaces Proxmox-specific daemon activity (such as pveproxy ACL warnings) and ESXi-import tooling errors related to VMware migration. For security operations, this data provides visibility into SSH authentication attempts and disconnections, privileged session activity, and service-level behavior on virtualization infrastructure that frequently hosts critical workloads.

## Supported data types

### Proxmox VE Host Syslog (System/Auth Events)

**Table name:** `proxmox_host_syslog`

This data type contains the host-level syslog/journald stream forwarded from Proxmox VE nodes, capturing SSH authentication and disconnection events, PAM session open/close activity, systemd service and socket lifecycle events, and occasional Proxmox-specific daemon output (e.g. pveproxy ACL warnings) or ESXi-import tooling errors. It is primarily useful for tracking authentication activity and privileged session behavior on virtualization hosts.

**Expected format**

Logs are expected in JSON format.

`{"message": "<38>Feb 4 03:32:10 host-d4e5f6 sshd-session[64563]: Accepted password for admin from 192.0.2.20 port 59302 ssh2", "src_host": "host-d4e5f6.example.com", "src_ip": "192.0.2.11"}`

## Send data to Hunters

Hunters supports the collection of Proxmox logs using S3.

**To connect Proxmox logs:**

1. Configure your Proxmox VE hosts to forward their syslog/journald stream (via your preferred log shipper or syslog forwarder) into an AWS S3 bucket, preserving the JSON envelope format described above. Refer to the [Proxmox VE Administration Guide](https://www.proxmox.com/en/downloads/proxmox-virtual-environment/documentation/proxmox-ve-admin-guide-for-9-x) and [Proxmox log files documentation](https://proxmoxr.com/blog/proxmox-log-files) for guidance on locating and forwarding host syslog data.
2. Once logs are landing in S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3) to connect the S3 bucket to Hunters.