The way syslog-ng interacts with the database
7.6. Sending messages to a remote logserver using the legacy BSD-syslog protocol
Thetcp(),tcp6(),udp(), andudp6()drivers send messages to another host (for example a syslog-ng server or relay) on the local intranet or internet using the UDP or TCP protocol. Thetcp6()andudp6()drivers use the IPv6 network protocol.
All four drivers have a single required parameter specifying the destination host address, where messages should be sent. For the list of available optional parameters, see Section 7.6.1, tcp(), tcp6(), udp(), and udp6() destination op-tions (p. 114).
Theudp()andudp6()drivers automatically send multicast packets if a multicast destination address is specified.
Thetcp()andtcp6()drivers do not support multicasting.
Declaration:
tcp(host [options]);
udp(host [options]);
tcp6(host [options]);
udp6(host [options]);
Example 7.12. Using the tcp() driver
destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); };
If name resolution is configured, the hostname of the target server can be used as well.
destination d_tcp { tcp("target_host" port(1999) localport(999)); };
To send messages using the IETF-syslog message format without using the IETF-syslog protocol, enable the syslog-protocolflag:
destination d_tcp { tcp("10.1.2.3" port(1999) flags(syslog-protocol) ); };
(For details on how to use the IETF-syslog protocol, see Section 7.5.1, syslog() destination options (p. 108).) Using an IPv6 address:
tcp6("fd00:abcd:4321:2:20c:29ff:fea8:9671" port(514));
ts_format()
7.6.1. tcp(), tcp6(), udp(), and udp6() destination options
This driver sends messages to another host on the local intranet or internet according to RFC3164 using the UDP or TCP protocol. Thetcp6()andudp6()drivers use the IPv6 network protocol.
Note
When using IPv6 destination addresses, always enclose the address between double-quotes:
tcp6("fd00:abcd:4321:2:20c:29ff:fea8:9671" port(514));
These destinations have the following options:
flags()
no_multi_line, syslog-protocol Type:
empty set Default:
Description: Flags influence the behavior of the destination driver.
■ no-multi-line: The no-multi-lineflag disables line-breaking in the messages; the entire message is converted to a single line.
■ syslog-protocol: Thesyslog-protocolflag instructs the driver to format the messages according to the new IETF syslog protocol standard. If this flag is enabled, macros used for the message have effect only for the text of the message, the message header is formatted to the new standard. Note that this flag is not needed for thesyslogdriver.
flush_lines() number Type:
Use global setting.
Default:
Description: Specifies how many lines are flushed to a destination at a time. Syslog-ng waits for this number of lines to accumulate and sends them off in a single batch. Setting this number high increases throughput as fully filled frames are sent to the destination, but also increases message latency. The latency can be limited by the use of theflush_timeoutoption.
flush_timeout()
time in milliseconds Type:
Use global setting.
Default:
Description: Specifies the time syslog-ng waits for lines to accumulate in its output buffer. For details, see the flush_linesoption.
frac_digits() number Type:
tcp(), tcp6(), udp(), and udp6() destination options
Description: The syslog-ng application can store fractions of a second in the timestamps according to the ISO8601 format.. Thefrac_digits()parameter specifies the number of digits stored. The digits storing the fractions are padded by zeros if the original timestamp of the message specifies only seconds. Fractions can always be stored for the time the message was received. Note that syslog-ng can add the fractions to non-ISO8601 timestamps as well.
Description: Specifies the Type-of-Service value of outgoing packets.
ip_ttl()
number Type:
0 Default:
Description: Specifies the Time-To-Live value of outgoing packets.
keep-alive() yes or no Type:
yes Default:
Description: Specifies whether connections to destinations should be closed when syslog-ng is restarted (upon the receipt of a SIGHUP signal). Note that this applies to the client (destination) side of the syslog-ng connections, server-side (source) connections are always reopened after receiving a HUP signal unless thekeep-aliveoption is enabled for the source. When thekeep-aliveoption is enabled, syslog-ng saves the contents of the output queue of the destination when receiving a HUP signal, reducing the risk of losing messages
localip() string Type:
0.0.0.0 Default:
Description: The IP address to bind to before connecting to target.
localport() number Type:
0 Default:
Description: The port number to bind to. Messages are sent from this port.
port() or destport() number Type:
514 Default:
tcp(), tcp6(), udp(), and udp6() destination options
Description: The port number to connect to. Note that the default port numbers used by syslog-ng do not comply with the latest RFC which was published after the release of syslog-ng 3.0.2, therefore the default port numbers will change in the future releases.
Note
The TCP port 514 is reserved for use withrshell, so select a different port if syslog-ng andrshellis used at the same time.
so_broadcast() yes or no Type:
no Default:
Description: This option controls theSO_BROADCASTsocket option required to make syslog-ng send messages to a broadcast address. For details, see thesocket(7)manual page.
so_keepalive() yes or no Type:
no Default:
Description: Enables keep-alive messages, keeping the socket open. This only effects TCP and UNIX-stream sockets. For details, see thesocket(7)manual page.
so_rcvbuf() number Type:
0 Default:
Description: Specifies the size of the socket receive buffer in bytes. For details, see thesocket(7)manual page.
so_sndbuf() number Type:
0 Default:
Description:Specifies the size of the socket send buffer in bytes. For details, see thesocket(7)manual page.
spoof_source() yes or no Type:
no Default:
Description: Enables source address spoofing. This means that the host running syslog-ng generates UDP packets with the source IP address matching the original sender of the message. It is useful when you want to perform some kind of preprocessing via syslog-ng then forward messages to your central log management solution with the
tcp(), tcp6(), udp(), and udp6() destination options
can be received by TCP as well. This option is only available if syslog-ng was compiled using the
Description: If several identical log messages would be sent to the destination without any other messages between the identical messages (for example, an application repeated an error message ten times), syslog-ng can suppress the repeated messages and send the message only once, followed by theLast message repeated n times.
message. The parameter of this option specifies the number of seconds syslog-ng waits for identical messages.
template() string Type:
A format conforming to the default logfile format.
Default:
Description: Specifies a template defining the logformat to be used in the destination. Macros are described in Section 11.1.4, Macros of syslog-ng OSE (p. 158). Please note that for network destinations it might not be appropriate to change the template as it changes the on-wire format of the syslog protocol which might not be tolerated by stock syslog receivers (likesyslogdor syslog-ng itself). For network destinations make sure the receiver can cope with the custom format defined.
template_escape() yes or no Type:
no Default:
Description: Turns on escaping for the',", and backspace characters in templated output files. This is useful for generating SQL statements and quoting string contents so that parts of the log message are not interpreted as commands to the SQL server.
throttle() number Type:
0 Default:
Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying0or a lower value sets the output limit to unlimited.
time_zone()
timezone in +/-HH:MM format Type:
unspecified Default:
Description: Convert timestamps to the timezone specified by this option. If this option is not set then the original timezone information in the message is used.
tcp(), tcp6(), udp(), and udp6() destination options
tls()
tls options Type:
n/a Default:
Description: This option sets various TLS specific options like key/certificate files and trusted CA locations. TLS can be used only with thetcptransport protocols. For details, see Section 10.4, TLS options (p. 153).
ts_format()
rfc3164, bsd, rfc3339, iso Type:
rfc3164 Default:
Description: Override the global timestamp format (set in the globalts_format()parameter) for the specific destination. For details, see Section 2.5.1, A note on timezones and timestamps (p. 9).