syslog-ng Open Source Edition 3.30 - Administration Guide

Description: The attributes() option adds extra metadata to the Riemann event, that can be displayed on the Riemann dashboard. To specify the metadata to add, use the syntax of the value-pairs() option. For details on using value-pairs(), see Structuring macros, metadata, and other value-pairs.

description()

Type:	template, macro, or string
Default:

Description: The value to add as the description field of the Riemann event.

disk-buffer()

Description: This option enables putting outgoing messages into the disk buffer of the destination to avoid message loss in case of a system failure on the destination side. It has the following options:

reliable()

Type:

yes|no

Default:

Description: If set to yes, syslog-ng OSE cannot lose logs in case of reload/restart, unreachable destination or syslog-ng OSE crash. This solution provides a slower, but reliable disk-buffer option. It is created and initialized at startup and gradually grows as new messages arrive. If set to no, the normal disk-buffer will be used. This provides a faster, but less reliable disk-buffer option.

Caution:

Hazard of data loss! If you change the value of reliable() option when there are messages in the disk-buffer, the messages stored in the disk-buffer will be lost.

compaction()
Type:	yes\|no
Default:	no
Description: If set to yes, syslog-ng OSE prunes the unused space in the LogMessage representation, making the disk queue size smaller at the cost of some CPU time. Setting the compaction() argument to yes is recommended when numerous name-value pairs are unset during processing, or when the same names are set multiple times.

NOTE: Simply unsetting these name-value pairs by using the unset() rewrite operation is not enough, as due to performance reasons that help when syslog-ng is CPU bound, the internal representation of a LogMessage will not release the memory associated with these name-value pairs. In some cases, however, the size of this overhead becomes significant (the raw message size can grow up to four times its original size), which unnecessarily increases the disk queue file size. For these cases, the compaction will drop "unset" values, making the LogMessage representation smaller at the cost of some CPU time required to perform compaction.

dir()

Type:

string

Default:

N/A

Description: Defines the folder where the disk-buffer files are stored.

Caution:

When creating a new dir() option for a disk buffer, or modifying an existing one, make sure you delete the persist file.

syslog-ng OSE creates disk-buffer files based on the path recorded in the persist file. Therefore, if the persist file is not deleted after modifying the dir() option, then following a restart, syslog-ng OSE will look for or create disk-buffer files in their old location. To ensure that syslog-ng OSE uses the new dir() setting, the persist file must not contain any information about the destinations which the disk-buffer file in question belongs to.

disk-buf-size()
Type:	number (bytes)
Default:
Description: This is a required option. The maximum size of the disk-buffer in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option.

mem-buf-length()
Type:	number (messages)
Default:	10000
Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes.

mem-buf-size()
Type:	number (bytes)
Default:	163840000
Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk buffer. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no.

qout-size()
Type:	number (messages)
Default:	64
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer already exists, the change will take effect when the disk-buffer becomes empty.

Options reliable() and disk-buf-size() are required options.

Example: Examples for using disk-buffer()

In the following case reliable disk-buffer() is used.

destination d_demo {
    network(
        "127.0.0.1"
        port(3333)
        disk-buffer(
            mem-buf-size(10000)
            disk-buf-size(2000000)
            reliable(yes)
            dir("/tmp/disk-buffer")
        )
    );
};

In the following case normal disk-buffer() is used.

destination d_demo {
    network(
        "127.0.0.1"
        port(3333)
           disk-buffer(
            mem-buf-length(10000)
            disk-buf-size(2000000)
            reliable(no)
            dir("/tmp/disk-buffer")
        )
    );
};

event-time()

Type:	template, macro, or string
Default:	${UNIXTIME}

Description: Instead of the arrival time into Riemann, syslog-ng OSE can also send its own timestamp value.

This can be useful if Riemann is inaccessible for a while, and the messages are collected in the disk buffer until Riemann is accessible again. In this case, it would be difficult to differentiate between messages based on the arrival time only, because this would mean that there would be hundreds of messages with the same arrival time. This issue can be solved by using this option.

The event-time() option takes an optional parameter specifying whether the time format is in seconds or microseconds. For example:

event-time("$(* $UNIXTIME 1000000)" microseconds)
event-time("12345678" microseconds)
event-time("12345678" seconds)
event-time("12345678")

In case the parameter is omitted, syslog-ng OSE defaults to the seconds version. In case the event-time() option is omitted altogether, syslog-ng OSE defaults to the seconds version with $UNIXTIME.

Note that the time format parameter requires:

riemann-c-client 1.10.0 or newer

In older versions of riemann-c-client, the microseconds option is not available.

In case your distribution does not contain a recent enough version of riemann-c-client and you wish to use microseconds, install a new version from .

If you installed the new version in a custom location (instead of the default one), make sure that you append the directory of the pkg-config file (.pc file) to the environment variable export PKG_CONFIG_PATH=....

After calling configure, you should see the following message in the case of successful installation:
```
[...]
 Riemann destination (module): yes, microseconds: yes
[...]
```
Riemann 2.13 or newer

Older versions of Riemann cannot handle microseconds. No error will be indicated, however, the time of the event will be set to the timestamp when the message arrived to Riemann.

Example: Example event-time() option

destination d_riemann {
   riemann(
   server("127.0.0.1")
   port(5555)
   event-time("${UNIXTIME}")
   [...]
   );
};

batch-bytes()

Accepted values:	number [bytes]
Default:	none

Description: Sets the maximum size of payload in a batch. If the size of the messages reaches this value, syslog-ng OSE sends the batch to the destination even if the number of messages is less than the value of the batch-lines() option.

Note that if the batch-timeout() option is enabled and the queue becomes empty, syslog-ng OSE flushes the messages only if batch-timeout() expires, or the batch reaches the limit set in batch-bytes().

Available in syslog-ng OSE version 3.19 and later.

batch-lines()

Type:	number
Default:	1

Description: Specifies how many lines are flushed to a destination in one batch. The syslog-ng OSE application waits for this number of lines to accumulate and sends them off in a single batch. Increasing this number increases throughput as more messages are sent in a single batch, but also increases message latency.

For example, if you set batch-lines() to 100, syslog-ng OSE waits for 100 messages.

If the batch-timeout() option is disabled, the syslog-ng OSE application flushes the messages if it has sent batch-lines() number of messages, or the queue became empty. If you stop or reload syslog-ng OSE or in case of network sources, the connection with the client is closed, syslog-ng OSE automatically sends the unsent messages to the destination.

For optimal performance, make sure that the syslog-ng OSE source that feeds messages to this destination is configured properly: the value of the log-iw-size() option of the source must be higher than the batch-lines()*workers() of the destination. Otherwise, the size of the batches cannot reach the batch-lines() limit.

If an error occurs while sending the messages to the server, syslog-ng OSE will try to resend every message from the batch. If it does not succeed (you can set the number of retry attempts in the retries() option), syslog-ng OSE drops every message in the batch.

batch-timeout()

Type:	time in milliseconds
Default:	-1 (disabled)

Description: Specifies the time syslog-ng OSE waits for lines to accumulate in the output buffer. The syslog-ng OSE application sends batches to the destinations evenly. The timer starts when the first message arrives to the buffer, so if only few messages arrive, syslog-ng OSE sends messages to the destination at most once every batch-timeout() milliseconds.

hook-commands()

Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.

NOTE: The syslog-ng OSE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng OSE to execute external applications.

Using the hook-commands() when syslog-ng OSE starts or stops

To execute an external program when syslog-ng OSE starts or stops, use the following options:

startup()
Type:	string
Default:	N/A
Description: Defines the external program that is executed as syslog-ng OSE starts.

shutdown()
Type:	string
Default:	N/A
Description: Defines the external program that is executed as syslog-ng OSE stops.

Using the hook-commands() when syslog-ng OSE reloads

To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:

setup()
Type:	string
Default:	N/A
Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload.

teardown()
Type:	string
Default:	N/A
Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload.

Example: Using the hook-commands() with a network source

In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.

The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng OSE created rule is there, packets can flow, otherwise the port is closed.

source {
   network(transport(udp)
	hook-commands(
          startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
          shutdown("iptables -D LOGCHAIN 1")
        )
     );
};

host()

Type:	template, macro, or string
Default:	${HOST}

Description: The value to add as the host field of the Riemann event.

log-fifo-size()

Type:	number
Default:	Use global setting.

Description: The number of messages that the output queue can store.

metric()

Type:	template, macro, or string
Default:

Description: The numeric value to add as the metric field of the Riemann event. If possible, include type-hinting as well, otherwise the Riemann server will interpret the value as a floating-point number. The following example specifies the SEQNUM macro as an integer.

metric(int("$SEQNUM"))

port()

Type:	number
Default:	5555

Description: The port number of the Riemann server.

retries()

Type:	number (of attempts)
Default:	3

Description: The number of times syslog-ng OSE attempts to send a message to this destination. If syslog-ng OSE could not send a message, it will try again until the number of attempts reaches retries, then drops the message.

server()

Type:	hostname or IP address
Default:	127.0.0.1

Description: The hostname or IP address of the Riemann server.

service()

Type:	template, macro, or string
Default:	${PROGRAM}

Description: The value to add as the service field of the Riemann event.

state()

Type:	template, macro, or string
Default:

Description: The value to add as the state field of the Riemann event.

tags()

Type:	string list
Default:	the tags already assigned to the message

Description: The list of tags to add as the tags field of the Riemann event. If not specified syslog-ng OSE automatically adds the tags already assigned to the message. If you set the tags() option, only the tags you specify will be added to the event.

throttle()

Type:	number
Default:	0

Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.

timeout()

Type:	number [seconds]
Default:

Description: The value (in seconds) to wait for an operation to complete, and attempt to reconnect the Riemann server if exceeded. By default, the timeout is disabled.

ttl()

Type:	template, macro, or number
Default:

Description: The value (in seconds) to add as the ttl (time-to-live) field of the Riemann event.

type()

Type:	tcp \| tls \| udp
Default:	tcp

Description: The type of the network connection to the Riemann server: TCP, TLS, or UDP. For TLS connections, set the ca-file() option to authenticate the Riemann server, and the cert-file() and key-file() options if the Riemann server requires authentication from its clients.

Declaration 1:

destination d_riemann {
	riemann(
		server("127.0.0.1")
		port(5672)
		type(
		   "tls"
		   ca-file("ca")
		   cert-file("cert") 
		   key-file("key")
		)
	);
};

An alternative way to specify TLS options is to group them into a tls() block. This allows you to separate them and ensure better readability.

Declaration 2:

destination d_riemann {
	riemann(
		server("127.0.0.1")
		port(5672)
		type("tls")
		tls(
			ca-file("ca")
			cert-file("cert") 
			key-file("key")
		)
	);
};

Make sure that you specify TLS options either using type() or using the tls() block. Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

ca-file()
Type:	path to a CA certificate in PEM format
Default:
Description: Path to the CA certificate in PEM format that signed the certificate of the Riemann server. When establishing TLS connection, syslog-ng OSE verifies the certificate of the Riemann server using this CA. Alternative 1: type( "tls" ca-file("/opt/syslog-ng/etc/syslog-ng/riemann-cacert.pem") ) Alternative 2: riemann( . . type("tls") tls( ca-file("/opt/syslog-ng/etc/syslog-ng/riemann-cacert.pem") ) This option was called cacert() up until (and including) syslog-ng OSE version 3.12.

cert-file()
Type:	path to a certificate in PEM format
Default:
Description: Path to the a certificate file in PEM format. When establishing TLS connection, syslog-ng OSE authenticates on the Riemann server using this certificate and the matching private key set in the key-file() option. Note that you have to set the cert-file() and key-file() options only if the Riemann server requires authentication from the clients. Alternative 1: type( "tls" cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) Alternative 2: riemann( . . type("tls") tls( cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) This option was called cert() in syslog-ng OSE version 3.7.

key-file()
Type:	path to a private key file
Default:
Description: Path to the private key of the certificate file set in the cert-file() option. When establishing TLS connection, syslog-ng OSE authenticates on the Riemann server using this private key and the matching certificate set in the cert-file() option. Note that you have to set the cert-file() and key-file() options only if the Riemann server requires authentication from the clients. Alternative 1: type( "tls" cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) Alternative 2: riemann( . . type("tls") tls( cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) This option was called key() in syslog-ng OSE version 3.7.

slack: Sending alerts and notifications to a Slack channel

destination: Forward, send, and store log messages > slack: Sending alerts and notifications to a Slack channel

The slack() destination driver sends messages to a Slack channel using the Slack Web API. For the list of available optional parameters, see Slack destination options. This destination is available in version 3.19 and later.

Declaration:

destination d_slack {
  slack(
    hook-url("https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX")
  );
};

The driver allows you to modify nearly every field of the HTTP request. For details, see the Slack API documentation.

You can use the proxy() option to configure the HTTP driver in all HTTP-based destinations to use a specific HTTP proxy that is independent from the proxy configured for the system.

By default, the throttle() option is set to 1, because Slack has a 1 message/second limit on Webhooks. It can allow more message in short bursts, so you can set it to 0, if you only expect messages in a short period of time. For details, see the Web API rate limiting in the Slack documentation.

To use this destination, the scl.conf file must be included in your syslog-ng OSE configuration:

@include "scl.conf"

The slack() driver is actually a reusable configuration snippet configured to send log messages using the http() driver. For details on using or writing such configuration snippets, see Reusing configuration blocks. You can find the source of this configuration snippet on GitHub.

Prerequisites

To send messages and notifications from syslog-ng OSE to Slack, you must create a Slack app and a Webhook that syslog-ng OSE can use. For details, see the Slack documentation.

Example: Using the slack() driver

The following example sets the colors and the author of the message.

@include "scl.conf"

destination d_slack1 {
  slack(
    hook-url("https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX")
    colors("#000000,#222222,#444444,#666666,#888888,#AAAAAA,#CCCCCC,#EEEEEE")
    color-chooser(7)
    author-name("syslog-ng BOT")
    author-link("https://www.syslog-ng.com/products/open-source-log-management")
    author-icon("https://raw.githubusercontent.com/MrAnno/vscode-syslog-ng/master/images/syslog-ng-icon.png")
  );
};

Slack destination options

destination: Forward, send, and store log messages > slack: Sending alerts and notifications to a Slack channel > Slack destination options

The slack destination of syslog-ng OSE can directly post log messages and notifications to Slack channels. The slack destination has the following options.

author-name()

Type:	string or template
Default:	'host: ${HOST} \| program: ${PROGRAM}(${PID}) \| severity: ${PRIORITY}'

Description: The sender of the message as displayed in Slack. For details, see the author_name option in the Slack documentation.

author-link()

Type:	string or URL
Default:	None

Description: A hyperlink for the sender of the message as displayed in Slack. For details, see the author_link option in the Slack documentation.

author-icon()

Type:	URL
Default:	None

Description: A hyperlink for icon of the author to be displayed in Slack. For details, see the author_icon option in the Slack documentation.

batch-bytes()

Accepted values:	number [bytes]
Default:	none

Available in syslog-ng OSE version 3.19 and later.

For details on how this option influences batch mode, see http: Posting messages over HTTP without Java

batch-lines()

Type:	number
Default:	1

For example, if you set batch-lines() to 100, syslog-ng OSE waits for 100 messages.

For details on how this option influences batch mode, see http: Posting messages over HTTP without Java

batch-timeout()

Type:	time in milliseconds
Default:	-1 (disabled)

For details on how this option influences batch mode, see http: Posting messages over HTTP without Java

ca-dir()

Accepted values:	Directory name
Default:	none

Description: The name of a directory that contains a set of trusted CA certificates in PEM format. The CA certificate files have to be named after the 32-bit hash of the subject's name. This naming can be created using the c_rehash utility in openssl. For an example, see Configuring TLS on the syslog-ng clients. The syslog-ng OSE application uses the CA certificates in this directory to validate the certificate of the peer.

This option can be used together with the optional ca-file() option.

An alternative way to specify this option is to put it into a tls() block, together with any other TLS options. This allows you to separate these options and ensure better readability.

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

ca-file()

Accepted values:	Filename
Default:	none

Description: Name of a file that contains an X.509 CA certificate (or a certificate chain) in PEM format. The syslog-ng OSE application uses this certificate to validate the certificate of the HTTPS server. If the file contains a certificate chain, the file must begin with the certificate of the host, followed by the CA certificate that signed the certificate of the host, and any other signing CAs in order.

An alternative way to specify this option is to put it into a tls() block, together with any other TLS options. This allows you to separate these options and ensure better readability.

cipher-suite()

Accepted values:	Name of a cipher, or a colon-separated list
Default:	Depends on the OpenSSL version that syslog-ng OSE uses

Description: Specifies the cipher, hash, and key-exchange algorithms used for the encryption, for example, ECDHE-ECDSA-AES256-SHA384. The list of available algorithms depends on the version of OpenSSL used to compile syslog-ng OSE. To specify multiple ciphers, separate the cipher names with a colon, and enclose the list between double-quotes, for example:

cipher-suite("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384")

For a list of available algorithms, execute the openssl ciphers -v command. The first column of the output contains the name of the algorithms to use in the cipher-suite() option, the second column specifies which encryption protocol uses the algorithm (for example, TLSv1.2). That way, the cipher-suite() also determines the encryption protocol used in the connection: to disable SSLv3, use an algorithm that is available only in TLSv1.2, and that both the client and the server supports. You can also specify the encryption protocols using ssl-options().

You can also use the following command to automatically list only ciphers permitted in a specific encryption protocol, for example, TLSv1.2:

echo "cipher-suite(\"$(openssl ciphers -v | grep TLSv1.2 | awk '{print $1}' | xargs echo -n | sed 's/ /:/g' | sed -e 's/:$//')\")"

Note that starting with version 3.10, when syslog-ng OSE receives TLS-encrypted connections, the order of ciphers set on the syslog-ng OSE server takes precedence over the client settings.

An alternative way to specify this option is to put it into a tls() block, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher")
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

colors()

Type:	list of colors in hexadecimal format
Default:	'#512E5F,#B03A2E,#E74C3C,#F39C12,#F8C471,#7DCEA0,#5DADE2,#85929E'

Description: The colors to be assigned to the messages of different importance levels.

color-chooser()

Type:	integer or template
Default:	'${LEVEL_NUM}'

Description: An integer that assigns a color to the message from the list of colors set in the colors() option.

disk-buffer()

reliable()

Type:

yes|no

Default:

Caution:

Hazard of data loss! If you change the value of reliable() option when there are messages in the disk-buffer, the messages stored in the disk-buffer will be lost.

compaction()
Type:	yes\|no
Default:	no
Description: If set to yes, syslog-ng OSE prunes the unused space in the LogMessage representation, making the disk queue size smaller at the cost of some CPU time. Setting the compaction() argument to yes is recommended when numerous name-value pairs are unset during processing, or when the same names are set multiple times.

dir()

Type:

string

Default:

N/A

Description: Defines the folder where the disk-buffer files are stored.

Caution:

When creating a new dir() option for a disk buffer, or modifying an existing one, make sure you delete the persist file.

disk-buf-size()
Type:	number (bytes)
Default:
Description: This is a required option. The maximum size of the disk-buffer in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option.

mem-buf-length()
Type:	number (messages)
Default:	10000
Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes.

mem-buf-size()
Type:	number (bytes)
Default:	163840000
Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk buffer. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no.

qout-size()
Type:	number (messages)
Default:	64
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer already exists, the change will take effect when the disk-buffer becomes empty.

Options reliable() and disk-buf-size() are required options.

Example: Examples for using disk-buffer()

In the following case reliable disk-buffer() is used.

destination d_demo {
    network(
        "127.0.0.1"
        port(3333)
        disk-buffer(
            mem-buf-size(10000)
            disk-buf-size(2000000)
            reliable(yes)
            dir("/tmp/disk-buffer")
        )
    );
};

In the following case normal disk-buffer() is used.

destination d_demo {
    network(
        "127.0.0.1"
        port(3333)
           disk-buffer(
            mem-buf-length(10000)
            disk-buf-size(2000000)
            reliable(no)
            dir("/tmp/disk-buffer")
        )
    );
};

fallback()

Type:	string or template
Default:	'${MSG} - host: ${HOST} \| program: ${PROGRAM}(${PID}) \| severity: ${PRIORITY}'

Description: The plain-text summary of the Slack attachment. For details, see the fallback option in the Slack documentation.

footer()

Type:	URL
Default:	string or template

Description: The footer of the message. For details, see the footer option in the Slack documentation.

footer-icon()

Type:	URL
Default:	None

Description: A hyperlink for an image. For details, see the footer_icon option in the Slack documentation.

hook-commands()

Using the hook-commands() when syslog-ng OSE starts or stops

To execute an external program when syslog-ng OSE starts or stops, use the following options:

startup()
Type:	string
Default:	N/A
Description: Defines the external program that is executed as syslog-ng OSE starts.

shutdown()
Type:	string
Default:	N/A
Description: Defines the external program that is executed as syslog-ng OSE stops.

Using the hook-commands() when syslog-ng OSE reloads

To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:

setup()
Type:	string
Default:	N/A
Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload.

teardown()
Type:	string
Default:	N/A
Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload.

Example: Using the hook-commands() with a network source

In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.

source {
   network(transport(udp)
	hook-commands(
          startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
          shutdown("iptables -D LOGCHAIN 1")
        )
     );
};

hook-url()

Type:	URL
Default:	None

Description: The Webhook URL for the Incoming Webhook of your Slack app. This URL must also include the authentication token that syslog-ng OSE uses to authenticate to Slack. For example: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

For details, see the Slack documentation about Incoming Webhooks.

image-url()

Type:	URL
Default:	None

Description: A hyperlink for an image. For details, see the image_url option in the Slack documentation.

log-fifo-size()

Type:	number
Default:	Use global setting.

Description: The number of messages that the output queue can store.

persist-name()

Type:	string
Default:

Description:If you receive the following error message during syslog-ng OSE startup, set the persist-name() option of the duplicate drivers:

Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting down.

This error happens if you use identical drivers in multiple sources, for example, if you configure two file sources to read from the same file. In this case, set the persist-name() of the drivers to a custom string, for example, persist-name("example-persist-name1").

pretext()

Type:	string or template
Default:	None

Description: The text that appears above the attachment block. For details, see the pretext option in the Slack documentation.

retries()

Type:	number (of attempts)
Default:	3

To handle HTTP error responses, if the HTTP server returns 5xx codes, syslog-ng OSE will attempt to resend messages until the number of attempts reaches retries. If the HTTP server returns 4xx codes, syslog-ng OSE will drop the messages.

ssl-version()

Type:	string
Default:	None, uses the libcurl default

Description: Specifies the permitted SSL/TLS version. Possible values: sslv2, sslv3, tlsv1, tlsv1_0, tlsv1_1, tlsv1_2, tlsv1_3.

An alternative way to specify this option is to put it into a tls() block, together with any other TLS options. This allows you to separate these options and ensure better readability.

template()

Type:	string
Default:	A format conforming to the default logfile format.

Description: Specifies a template defining the logformat to be used in the destination. Macros are described in Macros of syslog-ng OSE. Please note that for network destinations it might not be appropriate to change the template as it changes the on-wire format of the syslog protocol which might not be tolerated by stock syslog receivers (like syslogd or syslog-ng itself). For network destinations make sure the receiver can cope with the custom format defined.

throttle()

Type:	number
Default:	0

thumb-url()

Type:	URL
Default:	None

Description: A hyperlink for a thumbnail image. For details, see the thumb_url option in the Slack documentation.

timeout()

Type:	number [seconds]
Default:	0

Description: The value (in seconds) to wait for an operation to complete, and attempt to reconnect the server if exceeded. By default, the timeout value is 0, meaning that there is no timeout. Available in version 3.11 and later.

title()

Type:	string or template
Default:	None

Description: The message title in Slack. For details, see the title option in the Slack documentation.

title-link()

Type:	URL
Default:	None

Description: A hyperlink for the message title in Slack. For details, see the title_link option in the Slack documentation.

user-agent()

Type:	string
Default:	syslog-ng [version]/libcurl[version]

Description: The value of the USER-AGENT header in the messages sent to the server.

use-system-cert-store()

Type:	yes \| no
Default:	no

Description: Use the certificate store of the system for verifying HTTPS certificates. For details, see the curl documentation.

workers()

Type:	integer
Default:	1

Description: Specifies the number of worker threads (at least 1) that syslog-ng OSE uses to send messages to the server. Increasing the number of worker threads can drastically improve the performance of the destination.

Caution:

Hazard of data loss. When you use more than one worker threads together with disk-based buffering, syslog-ng OSE creates a separate disk buffer for each worker thread. This means that decreasing the number of workers can result in losing data currently stored in the disk buffer files. Do not decrease the number of workers when the disk buffer files are in use.

If you are using load-balancing (that is, you have configured multiple servers in the url() option), increase the number of worker threads at least to the number of servers. For example, if you have set three URLs (url("site1", "site2", "site3")), set the workers() option to 3 or more.

smtp: Generating SMTP messages (email) from logs

destination: Forward, send, and store log messages > smtp: Generating SMTP messages (email) from logs

The destination is aimed at a fully controlled local, or near-local, trusted SMTP server. The goal is to send mail to trusted recipients, through a controlled channel. It hands mails over to an SMTP server, and that is all it does, therefore the resulting solution is as reliable as sending an email in general. For example, syslog-ng OSE does not verify whether the recipient exists.

The smtp() driver sends email messages triggered by log messages. The smtp() driver uses SMTP, without needing external applications. You can customize the main fields of the email, add extra headers, send the email to multiple recipients, and so on.

The subject(), body(), and header() fields may include macros which get expanded in the email. For more information on available macros see Macros of syslog-ng OSE.

The smtp() driver has the following required parameters: host(), port(), from(), to(), subject(), and body(). For the list of available optional parameters, see smtp() destination options.

NOTE: The smtp() destination driver is available only in syslog-ng OSE 3.4 and later.

Declaration:

smtp(host() port() from() to() subject() body() options());

Example: Using the smtp() driver

The following example defines an smtp() destination using only the required parameters.

destination d_smtp {
    smtp(
        host("localhost")
        port(25)
        from("syslog-ng alert service" "noreply@example.com")
        to("Admin #1" "admin1@example.com")
        subject("[ALERT] Important log message of $LEVEL condition received from $HOST/$PROGRAM!")
        body("Hi!\nThe syslog-ng alerting service detected the following important log message:\n $MSG\n-- \nsyslog-ng\n")
    );
};

The following example sets some optional parameters as well.

destination d_smtp {
    smtp(
        host("localhost")
        port(25)
        from("syslog-ng alert service" "noreply@example.com")
        to("Admin #1" "admin1@example.com")
        to("Admin #2" "admin2@example.com")
        cc("Admin BOSS" "admin.boss@example.com")
        bcc("Blind CC" "blindcc@example.com")
        subject("[ALERT] Important log message of $LEVEL condition received from $HOST/$PROGRAM!")
        body("Hi!\nThe syslog-ng alerting service detected the following important log message:\n $MSG\n-- \nsyslog-ng\n")
        header("X-Program", "$PROGRAM")
        );
};

Example: Simple email alerting with the smtp() driver

The following example sends an email alert if the eth0 network interface of the host is down.

filter f_linkdown {
    match("eth0: link down" value("MESSAGE"));
};
destination d_alert {
    smtp(
        host("localhost") port(25)
        from("syslog-ng alert service" "syslog@localhost")
        reply-to("Admins" "root@localhost")
        to("Ennekem" "me@localhost")
        subject("[SYSLOG ALERT]: eth0 link down")
        body("Syslog received an alert:\n$MSG")
        );
};

log {
    source(s_local);
    filter(f_linkdown);
    destination(d_alert);
};

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación

Seleccione su producto:

Con el fin de ofrecerle un mejor servicio, complete el campo Motivo del chat:

Soluciones recomendadas para su problema

syslog-ng Open Source Edition 3.30 - Administration Guide

riemann() destination options

attributes()

description()

disk-buffer()

Example: Examples for using disk-buffer()

event-time()

Example: Example event-time() option

batch-bytes()

batch-lines()

batch-timeout()

hook-commands()

Using the hook-commands() when syslog-ng OSE starts or stops

Using the hook-commands() when syslog-ng OSE reloads

Example: Using the hook-commands() with a network source

host()

log-fifo-size()

metric()

port()

retries()

server()

service()

state()

tags()

throttle()

timeout()

ttl()

type()

Declaration 1:

Declaration 2:

slack: Sending alerts and notifications to a Slack channel

Declaration:

Prerequisites

Example: Using the slack() driver

Slack destination options

author-name()

author-link()

author-icon()

batch-bytes()

batch-lines()

batch-timeout()

ca-dir()

ca-file()

cipher-suite()

Declaration:

colors()

color-chooser()

disk-buffer()

Example: Examples for using disk-buffer()

fallback()

footer()

footer-icon()

hook-commands()

Using the hook-commands() when syslog-ng OSE starts or stops

Using the hook-commands() when syslog-ng OSE reloads

Example: Using the hook-commands() with a network source

hook-url()

image-url()

log-fifo-size()

persist-name()

pretext()

retries()

ssl-version()

template()

throttle()

thumb-url()

timeout()

title()

title-link()

user-agent()

use-system-cert-store()

workers()

smtp: Generating SMTP messages (email) from logs

Declaration:

Example: Using the smtp() driver

Example: Simple email alerting with the smtp() driver