Name
syslog-ng-ctl — Display message statistics and enable verbose, debug and trace modes in syslog-ng Premium Edition
Synopsis
syslog-ng-ctl [command] [options]
Description
NOTE: The syslog-ng-ctl application is distributed with the syslog-ng Premium Edition system logging application, and is usually part of the syslog-ng package. The latest version of the syslog-ng application is available at syslog-ng page.
This manual page is only an abstract, for the complete documentation of syslog-ng, see the syslog-ng Documentation page.
The syslog-ng-ctl application is a utility that can be used to:
-
enable/disable various syslog-ng messages for troubleshooting
-
display statistics about the processed messages
-
handling password-protected private keys
-
display the currently running configuration of syslog-ng PE
-
reload the configuration of syslog-ng PE.
-
stop syslog-ng PE.
Enabling troubleshooting messages
Use the syslog-ng-ctl <command> --set=on command to display verbose, trace, or debug messages. If you are trying to solve configuration problems, the verbose (and occasionally trace) messages are usually sufficient. Debug messages are needed mostly for finding software errors. After solving the problem, do not forget to turn these messages off using the syslog-ng-ctl <command> --set=off. Note that enabling debug messages does not enable verbose and trace messages.
Use syslog-ng-ctl <command> without any parameters to display whether the particular type of messages are enabled or not.
If you need to use a non-standard control socket to access syslog-ng, use the syslog-ng-ctl <command> --set=on --control=<socket> command to specify the socket to use.
- verbose
-
Print verbose messages. If syslog-ng was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng will log such messages to its internal source.
- trace
-
Print trace messages of how messages are processed. If syslog-ng was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng will log such messages to its internal source.
- debug
-
Print debug messages. If syslog-ng was started with the --stderr or -e option, the messages will be sent to stderr. If not specified, syslog-ng will log such messages to its internal source.
Example:
syslog-ng-ctl verbose --set=on
syslog-ng-ctl query
The syslog-ng PE application stores various data, metrics, and statistics in a hash table. Every property has a name and a value. For example:
[syslog-ng]
|
|_[destinations]-[network]-[tcp]->[stats]->{received=12;dropped=2}
|
|_[sources]-[sql]-[stats]->{received=501;dropped=0}
You can query the nodes of this tree, and also use filters to select the information you need. A query is actually a path in the tree. You can also use the ? and * wildcards. For example:
The nodes and properties available in the tree depend on your syslog-ng PE configuration (that is, the sources, destinations, and other objects you have configured), and also on your stats-level() settings.
The list command
Use the syslog-ng-ctl query list command to display the list of metrics that syslog-ng PE collects about the processed messages. For details about the displayed metrics, see The syslog-ng Administrator Guide ???.
An example output:
center.received.stats.processed
center.queued.stats.processed
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.dropped
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.processed
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.queued
destination.d_elastic.stats.processed
source.s_tcp.stats.processed
source.severity.7.stats.processed
source.severity.0.stats.processed
source.severity.1.stats.processed
source.severity.2.stats.processed
source.severity.3.stats.processed
source.severity.4.stats.processed
source.severity.5.stats.processed
source.severity.6.stats.processed
source.facility.7.stats.processed
source.facility.16.stats.processed
source.facility.8.stats.processed
source.facility.17.stats.processed
source.facility.9.stats.processed
source.facility.18.stats.processed
source.facility.19.stats.processed
source.facility.20.stats.processed
source.facility.0.stats.processed
source.facility.21.stats.processed
source.facility.1.stats.processed
source.facility.10.stats.processed
source.facility.22.stats.processed
source.facility.2.stats.processed
source.facility.11.stats.processed
source.facility.23.stats.processed
source.facility.3.stats.processed
source.facility.12.stats.processed
source.facility.4.stats.processed
source.facility.13.stats.processed
source.facility.5.stats.processed
source.facility.14.stats.processed
source.facility.6.stats.processed
source.facility.15.stats.processed
source.facility.other.stats.processed
global.payload_reallocs.stats.processed
global.msg_clones.stats.processed
global.sdata_updates.stats.processed
tag..source.s_tcp.stats.processed
The syslog-ng-ctl query list command has the following options:
- --reset
-
Use --reset to set the selected counters to 0 after executing the query.
Displaying metrics and statistics
syslog-ng-ctl query get [options]
The syslog-ng-ctl query get <query> command lists the nodes that match the query, and their values.
For example, the "destination*" query lists the configured destinations, and the metrics related to each destination. An example output:
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.dropped=0
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.processed=0
destination.java.d_elastic#0.java_dst(ElasticSearch,elasticsearch-syslog-ng-test,t7cde889529c034aea9ec_micek).stats.queued=0
destination.d_elastic.stats.processed=0
The syslog-ng-ctl query get command has the following options:
- --sum
-
Add up the result of each matching node and return only a single number.
For example, the syslog-ng-ctl query get --sum "destination*.dropped" command displays the number of messages dropped by the syslog-ng PE instance.
- --reset
-
Use --reset to set the selected counters to 0 after executing the query.
The stats command
Use the stats command to display statistics about the processed messages. For details about the displayed statistics, see The syslog-ng Administrator Guide ???. The stats command has the following options:
- --control=<socket> or -c
-
Specify the socket to use to access syslog-ng. Only needed when using a non-standard socket.
- --reset=<socket> or -r
-
Reset all statistics to zero, except for the queued counters. (The queued counters show the number of messages in the message queue of the destination driver, waiting to be sent to the destination.)
Example:
syslog-ng-ctl stats
An example output:
src.internal;s_all#0;;a;processed;6445
src.internal;s_all#0;;a;stamp;1268989330
destination;df_auth;;a;processed;404
destination;df_news_dot_notice;;a;processed;0
destination;df_news_dot_err;;a;processed;0
destination;d_ssb;;a;processed;7128
destination;df_uucp;;a;processed;0
source;s_all;;a;processed;7128
destination;df_mail;;a;processed;0
destination;df_user;;a;processed;1
destination;df_daemon;;a;processed;1
destination;df_debug;;a;processed;15
destination;df_messages;;a;processed;54
destination;dp_xconsole;;a;processed;671
dst.tcp;d_network#0;10.50.0.111:514;a;dropped;5080
dst.tcp;d_network#0;10.50.0.111:514;a;processed;7128
dst.tcp;d_network#0;10.50.0.111:514;a;queued;2048
destination;df_syslog;;a;processed;6724
destination;df_facility_dot_warn;;a;processed;0
destination;df_news_dot_crit;;a;processed;0
destination;df_lpr;;a;processed;0
destination;du_all;;a;processed;0
destination;df_facility_dot_info;;a;processed;0
center;;received;a;processed;0
destination;df_kern;;a;processed;70
center;;queued;a;processed;0
destination;df_facility_dot_err;;a;processed;0
Displaying license-related information
syslog-ng-ctl show-license-info [options]
The syslog-ng PE application uses a license in server mode to determine the maximum number of hosts that are allowed to connect. Use the syslog-ng-ctl show-license-info command to display license-related information the number of hosts currently logging to your server. This helps you to plan your capacity, to check your license usage, and to detect client misconfiguration that can result in a license miscount anomaly. Note that in client or relay mode, syslog-ng PE does not require a license.
The syslog-ng-ctl show-license-info command displays the following information. In case of an unlimited license, or in client or relay mode, only the license type is displayed:
-
License Type: none, limited, unlimited
-
Host Limit: the maximum number of hosts that are allowed to connect.
-
Currently Used Slots: the number of currently used host slots
-
Usage: the percent of used host slots
-
Licensed Clients: the list of hostnames that are stored in the license module
-
Monthly-Consumed-License-Hosts: the current number of used hosts since the previous monthly host usage report. This item appears only if we have a valid and limited license, moreover, the option report-host-usage() is turned on.
The syslog-ng-ctl show-license-info command has the following options:
- --json or -J
-
Print license-related information in JSON format.
Example:
syslog-ng-ctl show-license-info
An example output:
License-Type: limited
Host-Limit: 10
Currently-Used-Slots: 7
Usage: 70%
Licensed-Clients:
192.168.0.1
192.168.0.2
192.168.0.3
192.168.1.4
192.168.1.5
Example:
syslog-ng-ctl show-license-info --json
An example output:
{
"license_type": "limited",
"host_limit": 10,
"currently_used_slots": 7,
"usage": "70%",
"licensed_clients": [
"xy.testdomain",
"testhost",
"192.168.0.3",
"test_host",
"192.168.1.5"
]
}
Example:
syslog-ng-ctl show-license-info
in case of an unlimited license
An example output:
$ syslog-ng-ctl show-license-info
License-Type: unlimited
Example:
syslog-ng-ctl show-license-info
if syslog-ng PE is in client or relay mode
An example output:
$ syslog-ng-ctl show-license-info
License-Type: none
Handling password-protected private keys
syslog-ng-ctl credentials [options]
The syslog-ng-ctl credentials status command allows you to query the status of the private keys that syslog-ng PE uses in the network() and syslog() drivers. You can also provide the passphrase for password-protected private keys using the syslog-ng-ctl credentials add command. For details on using password-protected keys, see The syslog-ng Administrator Guide ???.
Displaying the status of private keys
syslog-ng-ctl credentials status [options]
The syslog-ng-ctl credentials status command allows you to query the status of the private keys that syslog-ng PE uses in the network() and syslog() drivers. The command returns the list of private keys used, and their status. For example:
syslog-ng-ctl credentials status
Secret store status:
/home/user/ssl_test/client-1/client-encrypted.key SUCCESS
If the status of a key is PENDING, you must provide the passphrase for the key, otherwise syslog-ng PE cannot use it. The sources and destinations that use these keys will not work until you provide the passwords. Other parts of the syslog-ng PE configuration will be unaffected. You must provide the passphrase of the password-protected keys every time syslog-ng PE is restarted.
The following log message also notifies you of PENDING passphrases:
Waiting for password; keyfile='private.key'
- --control=<socket> or -c
-
Specify the socket to use to access syslog-ng. Only needed when using a non-standard socket.
Opening password-protected private keys
syslog-ng-ctl credentials add [options]
You can add the passphrase to a password-protected private key file using the following command. syslog-ng PE will display a prompt for you to enter the passphrase. We recommend that you use this method.
syslog-ng-ctl credentials add --id=<path-to-the-key>
Alternatively, you can include the passphrase in the --secret parameter:
syslog-ng-ctl credentials add --id=<path-to-the-key> --secret=<passphrase-of-the-key>
Or you can pipe the passphrase to the syslog-ng-ctl command, for example:
echo "<passphrase-of-the-key>" | syslog-ng-ctl credentials add --id=<path-to-the-key>
- --control=<socket> or -c
-
Specify the socket to use to access syslog-ng. Only needed when using a non-standard socket.
- --id=<path-to-the-key> or -i
-
The path to the password-protected private key file. This is the same path that you use in the key-file() option of the syslog-ng PE configuration file.
- --secret=<passphrase-of-the-key> or -s
-
The password or passphrase of the private key.
Displaying the configuration
syslog-ng-ctl config [options]
Use the syslog-ng-ctl config command to display the configuration that syslog-ng PE is currently running. Note by default, only the content of the main configuration file are displayed, included files are not resolved. To resolve included files and display the entire configuration, use the syslog-ng-ctl config --preprocessed command.
Reloading the configuration
syslog-ng-ctl reload [options]
Use the syslog-ng-ctl reload command to reload the configuration file of syslog-ng PE without having to restart the syslog-ng PE application. The syslog-ng-ctl reload works like a SIGHUP (-1). On Microsoft Windows, this is the only way to reload the configuration of syslog-ng PE.
The syslog-ng-ctl reload command returns 0 if the operation was successful, 1 otherwise.
Stopping syslog-ng PE
syslog-ng-ctl stop [options]
Use the syslog-ng-ctl stop command to stop the syslog-ng PE application. The syslog-ng-ctl stop works like a SIGHUP (-15) on Linux and Unix systems. On Microsoft Windows, this is the only way to gracefully stop syslog-ng PE if it is running in the foreground.
Files
/opt/syslog-ng/sbin/syslog-ng-ctl
Author
This manual page was written by the One Identity Documentation Team.
Copyright
Copyright 2000-2022 One Identity. Published under the Creative Commons Attribution-Noncommercial-No Derivative Works (by-nc-nd) 3.0 license. For details, see https://creativecommons.org//. The latest version is always available at https://syslog-ng.com.
