syslog-ng Open Source Edition 3.16 - Administration Guide

Change an old destination driver to the network() driver

To replace your existing tcp(), tcp6(), udp(), udp6() destinations with a network() destination, complete the following steps.

1. Replace the driver with network. For example, replace udp( with network(

2. Set the transport protocol.

   • If you used TLS-encryption, add the transport("tls") option, then continue with the next step.

   • If you used the tcp or tcp6 driver, add the transport("tcp") option.

   • If you used the udp or udp driver, add the transport("udp") option.

3. If you use IPv6 (that is, the udp6 or tcp6 driver), add the ip-protocol(6) option.

4. If you did not specify the port used in the old driver, check network() destination options and verify that your clients send the messages to the default port of the transport protocol you use. Otherwise, set the appropriate port number in your source using the port() option.

5. All other options are identical. Test your configuration with the syslog-ng --syntax-only command.

   The following configuration shows a simple tcp destination.

   destination d_old_tcp {
       tcp(
           "127.0.0.1" port(1999)
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };

   When replaced with the network() driver, it looks like this.

   destination d_new_network_tcp {
       network(
           "127.0.0.1"
           port(1999)
           transport("tls")
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };

Telegram: Sending messages to Telegram

The telegram() destination sends log messages to Telegram, which is a secure, cloud-based mobile and desktop messaging app.

telegram(parameters);

destination d_telegram {
    telegram(
        template("$(urlencode\"${MSG}\")")
        throttle(1)
        parse-mode("markdown")
        disable-web-page-preview("true")
        bot-id("<bot id>")
        chat-id("<chat id>")
    );
};

telegram() destination options

The telegram() destination has the following options:

hook-commands()

Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.

Using the hook-commands() when syslog-ng OSE starts or stops

To execute an external program when syslog-ng OSE starts or stops, use the following options:

Using the hook-commands() when syslog-ng OSE reloads

To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:

source {
   network(transport(udp)
	hook-commands(
          startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
          shutdown("iptables -D LOGCHAIN 1")
        )
     );
};

template()

Description: Specifies the content of the message. For security reasons, One Identity recommends using urlencode in the template function.

throttle()

Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.

unix-stream, unix-dgram: Sending messages to UNIX domain sockets

The unix-stream() and unix-dgram() drivers send messages to a UNIX domain socket in either SOCK_STREAM or SOCK_DGRAM mode.

Both drivers have a single required argument specifying the name of the socket to connect to. For the list of available optional parameters, see unix-stream() and unix-dgram() destination options.

Declaration:

unix-stream(filename [options]);
unix-dgram(filename [options]);

destination d_unix_stream { unix-stream("/var/run/logs"); };