The redis() driver sends messages as name-value pairs to a Redis key-value store.
The redis() destination has the following options:
Type: | hostname or IP address |
Default: | N/A |
Description: The password used for authentication on a password-protected Redis server. Available in syslog-ng OSE version
Type: | comma-separated list of strings ("<redis-command>", "<first-command-parameter>", "<second-command-parameter>", "<third-command-parameter>") |
Default: | empty string |
Description: The Redis command to execute, for example, LPUSH, INCR, or HINCRBY. Using the HINCRBY command with an increment value of 1 allows you to create various statistics. For example, the command("HINCRBY" "${HOST}/programs" "${PROGRAM}" "1") command counts the number of log messages on each host for each program.
Note the following points when using the redis() destination:
You can use macros and templates in the parameters of the Redis command.
Currently you can use only one command in a redis() destination.
The syslog-ng OSE application ignores the return value of the command. If the Redis server returns an error, syslog-ng OSE closes the connection.
Description: This option enables putting outgoing messages into the disk buffer of the destination to avoid message loss in case of a system failure on the destination side. It has the following options:
reliable() | |||
Type: | yes|no | ||
Default: | no | ||
Description: If set to yes, syslog-ng OSE cannot lose logs in case of reload/restart, unreachable destination or syslog-ng OSE crash. This solution provides a slower, but reliable disk-buffer option. It is created and initialized at startup and gradually grows as new messages arrive. If set to no, the normal disk-buffer will be used. This provides a faster, but less reliable disk-buffer option.
|
disk-buf-size() | |
Type: | number (bytes) |
Default: | |
Description: This is a required option. The maximum size of the disk-buffer in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option. |
mem-buf-length() | |
Type: | number (messages) |
Default: | 10000 |
Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes. |
mem-buf-size() | |
Type: | number (bytes) |
Default: | 163840000 |
Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk buffer. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no. |
qout-size() | |
Type: | number (messages) |
Default: | 64 |
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer already exists, the change will take effect when the disk-buffer becomes empty. |
Options reliable() and disk-buf-size() are required options.
In the following case reliable disk-buffer() is used.
destination d_demo { network( "127.0.0.1" port(3333) disk-buffer( mem-buf-size(10000) disk-buf-size(2000000) reliable(yes) dir("/tmp/disk-buffer") ) ); };
In the following case normal disk-buffer() is used.
destination d_demo { network( "127.0.0.1" port(3333) disk-buffer( mem-buf-length(10000) disk-buf-size(2000000) reliable(no) dir("/tmp/disk-buffer") ) ); };
Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.
|
NOTE: The syslog-ng OSE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng OSE to execute external applications. |
To execute an external program when syslog-ng OSE starts or stops, use the following options:
startup() | |
Type: | string |
Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE starts. |
shutdown() | |
Type: | string |
Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE stops. |
To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:
setup() | |
Type: | string |
Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload. |
teardown() | |
Type: | string |
Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload. |
In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.
The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng OSE created rule is there, packets can flow, otherwise the port is closed.
source { network(transport(udp) hook-commands( startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT") shutdown("iptables -D LOGCHAIN 1") ) ); };
Type: | hostname or IP address |
Default: | 127.0.0.1 |
Description: The hostname or IP address of the Redis server.
Type: | number |
Default: | 6379 |
Description: The port number of the Redis server.
Type: | number (of attempts) |
Default: | 3 |
Description: The number of times syslog-ng OSE attempts to send a message to this destination. If syslog-ng OSE could not send a message, it will try again until the number of attempts reaches retries, then drops the message.
Type: | number |
Default: | 0 |
Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.
The riemann() driver sends your data (for example, metrics or events) to a Riemann monitoring system.
For the list of available parameters, see riemann() destination options.
riemann( server("<riemann-server-address>") port("<riemann-server-port>") metric("<the-metric-or-data-to-send-to-riemann>") );
The following destination sends the value of the SEQNUM macro (the number of messages sent to this destination) as a metric to the Riemann server.
@version: 3.18 source s_network { network(port(12345)); }; destination d_riemann { riemann( server("localhost") port(5555) ttl("300.5") metric(int("$SEQNUM")) description("syslog-ng riemann test") state("ok") attributes(x-ultimate-answer("$(+ $PID 42)") key("MESSAGE", rekey(add-prefix("x-")) ) ) ); }; log { source(s_network); destination(d_riemann); flags(flow-control); };
For a detailed use-case on using syslog-ng OSE with the Riemann monitoring system, see the article A How to Guide on Modern Monitoring and Alerting by Fabien Wernli.
The riemann() driver sends metrics or events to a Riemann monitoring system.
The riemann() destination has the following options:
Type: | parameter list of the value-pairs() option |
Default: |
Description: The attributes() option adds extra metadata to the Riemann event, that can be displayed on the Riemann dashboard. To specify the metadata to add, use the syntax of the value-pairs() option. For details on using value-pairs(), see Structuring macros, metadata, and other value-pairs.
Type: | template, macro, or string |
Default: |
Description: The value to add as the description field of the Riemann event.
Description: This option enables putting outgoing messages into the disk buffer of the destination to avoid message loss in case of a system failure on the destination side. It has the following options:
reliable() | |||
Type: | yes|no | ||
Default: | no | ||
Description: If set to yes, syslog-ng OSE cannot lose logs in case of reload/restart, unreachable destination or syslog-ng OSE crash. This solution provides a slower, but reliable disk-buffer option. It is created and initialized at startup and gradually grows as new messages arrive. If set to no, the normal disk-buffer will be used. This provides a faster, but less reliable disk-buffer option.
|
dir() | |||
Type: | string | ||
Default: | N/A | ||
Description: Defines the folder where the disk-buffer files are stored.
|
disk-buf-size() | |
Type: | number (bytes) |
Default: | |
Description: This is a required option. The maximum size of the disk-buffer in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option. |
mem-buf-length() | |
Type: | number (messages) |
Default: | 10000 |
Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes. |
mem-buf-size() | |
Type: | number (bytes) |
Default: | 163840000 |
Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk buffer. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no. |
qout-size() | |
Type: | number (messages) |
Default: | 64 |
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer already exists, the change will take effect when the disk-buffer becomes empty. |
Options reliable() and disk-buf-size() are required options.
In the following case reliable disk-buffer() is used.
destination d_demo { network( "127.0.0.1" port(3333) disk-buffer( mem-buf-size(10000) disk-buf-size(2000000) reliable(yes) dir("/tmp/disk-buffer") ) ); };
In the following case normal disk-buffer() is used.
destination d_demo { network( "127.0.0.1" port(3333) disk-buffer( mem-buf-length(10000) disk-buf-size(2000000) reliable(no) dir("/tmp/disk-buffer") ) ); };
Type: | template, macro, or string |
Default: | ${UNIXTIME} |
Description: Instead of the arrival time into Riemann, syslog-ng OSE can also send its own timestamp value.
This can be useful if Riemann is inaccessible for a while, and the messages are collected in the disk buffer until Riemann is accessible again. In this case, it would be difficult to differentiate between messages based on the arrival time only, because this would mean that there would be hundreds of messages with the same arrival time. This issue can be solved by using this option.
The event-time() option takes an optional parameter specifying whether the time format is in seconds or microseconds. For example:
event-time("$(* $UNIXTIME 1000000)" microseconds) event-time("12345678" microseconds) event-time("12345678" seconds) event-time("12345678")
In case the parameter is omitted, syslog-ng OSE defaults to the seconds version. In case the event-time() option is omitted altogether, syslog-ng OSE defaults to the seconds version with $UNIXTIME.
Note that the time format parameter requires:
riemann-c-client 1.10.0 or newer
In older versions of riemann-c-client, the microseconds option is not available.
In case your distribution does not contain a recent enough version of riemann-c-client and you wish to use microseconds, install a new version from .
If you installed the new version in a custom location (instead of the default one), make sure that you append the directory of the pkg-config file (.pc file) to the environment variable export PKG_CONFIG_PATH=....
After calling configure, you should see the following message in the case of successful installation:
[...] Riemann destination (module): yes, microseconds: yes [...]
Riemann 2.13 or newer
Older versions of Riemann cannot handle microseconds. No error will be indicated, however, the time of the event will be set to the timestamp when the message arrived to Riemann.
destination d_riemann { riemann( server("127.0.0.1") port(5555) event-time("${UNIXTIME}") [...] ); };
Type: | number |
Default: | 1 |
Description: The syslog-ng OSE application can send the messages in a batch to the Riemann server. To send messages in batches, increase the flush-lines() parameter (by default, it is set to 1). The syslog-ng OSE application waits for this number of lines to accumulate, and sends them off in a single batch. Increasing this number increases throughput as more messages are sent in a single batch, but also increases message latency. Note that currently the riemann() destination does not have a timeout for sending messages if the batch is not full.
For example, if you set flush-lines() to 100, syslog-ng OSE waits for 100 messages. If the source sends a few messages, but less than 100 messages, syslog-ng OSE will not send the messages to the destination. If you stop or reload syslog-ng OSE or in case of network sources, the connection with the client is closed, syslog-ng OSE automatically sends the unsent messages to the destination.
If an error occurs while sending the messages to the server, syslog-ng OSE will try to resend every message from the batch. If it does not succeed (you can set the number of retry attempts in the retries() option), syslog-ng OSE drops every message in the batch.
Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.
|
NOTE: The syslog-ng OSE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng OSE to execute external applications. |
To execute an external program when syslog-ng OSE starts or stops, use the following options:
startup() | |
Type: | string |
Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE starts. |
shutdown() | |
Type: | string |
Default: | N/A |
Description: Defines the external program that is executed as syslog-ng OSE stops. |
To execute an external program when the syslog-ng OSE configuration is initiated or torn down, for example, on startup/shutdown or during a syslog-ng OSE reload, use the following options:
setup() | |
Type: | string |
Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is initiated, for example, on startup or during a syslog-ng OSE reload. |
teardown() | |
Type: | string |
Default: | N/A |
Description: Defines an external program that is executed when the syslog-ng OSE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng OSE reload. |
In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically as syslog-ng OSE is started/stopped.
The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng OSE created rule is there, packets can flow, otherwise the port is closed.
source { network(transport(udp) hook-commands( startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT") shutdown("iptables -D LOGCHAIN 1") ) ); };
Type: | template, macro, or string |
Default: | ${HOST} |
Description: The value to add as the host field of the Riemann event.
Type: | number |
Default: | Use global setting. |
Description: The number of messages that the output queue can store.
Type: | template, macro, or string |
Default: |
Description: The numeric value to add as the metric field of the Riemann event. If possible, include type-hinting as well, otherwise the Riemann server will interpret the value as a floating-point number. The following example specifies the SEQNUM macro as an integer.
metric(int("$SEQNUM"))
Type: | number |
Default: | 5555 |
Description: The port number of the Riemann server.
Type: | number (of attempts) |
Default: | 3 |
Description: The number of times syslog-ng OSE attempts to send a message to this destination. If syslog-ng OSE could not send a message, it will try again until the number of attempts reaches retries, then drops the message.
Type: | hostname or IP address |
Default: | 127.0.0.1 |
Description: The hostname or IP address of the Riemann server.
Type: | template, macro, or string |
Default: | ${PROGRAM} |
Description: The value to add as the service field of the Riemann event.
Type: | template, macro, or string |
Default: |
Description: The value to add as the state field of the Riemann event.
Type: | string list |
Default: | the tags already assigned to the message |
Description: The list of tags to add as the tags field of the Riemann event. If not specified syslog-ng OSE automatically adds the tags already assigned to the message. If you set the tags() option, only the tags you specify will be added to the event.
Type: | number |
Default: | 0 |
Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.
Type: | number [seconds] |
Default: |
Description: The value (in seconds) to wait for an operation to complete, and attempt to reconnect the Riemann server if exceeded. By default, the timeout is disabled.
Type: | template, macro, or number |
Default: |
Description: The value (in seconds) to add as the ttl (time-to-live) field of the Riemann event.
Type: | tcp | tls | udp |
Default: | tcp |
Description: The type of the network connection to the Riemann server: TCP, TLS, or UDP. For TLS connections, set the ca-file() option to authenticate the Riemann server, and the cert-file() and key-file() options if the Riemann server requires authentication from its clients.
destination d_riemann { riemann( server("127.0.0.1") port(5672) type( "tls" ca-file("ca") cert-file("cert") key-file("key") ) ); };
An alternative way to specify TLS options is to group them into a tls() block. This allows you to separate them and ensure better readability.
destination d_riemann { riemann( server("127.0.0.1") port(5672) type("tls") tls( ca-file("ca") cert-file("cert") key-file("key") ) ); };
Make sure that you specify TLS options either using type() or using the tls() block. Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.
ca-file() | |
Type: | path to a CA certificate in PEM format |
Default: | |
Description: Path to the CA certificate in PEM format that signed the certificate of the Riemann server. When establishing TLS connection, syslog-ng OSE verifies the certificate of the Riemann server using this CA. Alternative 1: type( "tls" ca-file("/opt/syslog-ng/etc/syslog-ng/riemann-cacert.pem") ) Alternative 2: riemann( . . type("tls") tls( ca-file("/opt/syslog-ng/etc/syslog-ng/riemann-cacert.pem") ) This option was called cacert() up until (and including) syslog-ng OSE version 3.12. |
cert-file() | |
Type: | path to a certificate in PEM format |
Default: | |
Description: Path to the a certificate file in PEM format. When establishing TLS connection, syslog-ng OSE authenticates on the Riemann server using this certificate and the matching private key set in the key-file() option. Note that you have to set the cert-file() and key-file() options only if the Riemann server requires authentication from the clients. Alternative 1: type( "tls" cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) Alternative 2: riemann( . . type("tls") tls( cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) This option was called cert() in syslog-ng OSE version 3.7. |
key-file() | |
Type: | path to a private key file |
Default: | |
Description: Path to the private key of the certificate file set in the cert-file() option. When establishing TLS connection, syslog-ng OSE authenticates on the Riemann server using this private key and the matching certificate set in the cert-file() option. Note that you have to set the cert-file() and key-file() options only if the Riemann server requires authentication from the clients. Alternative 1: type( "tls" cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) Alternative 2: riemann( . . type("tls") tls( cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem") key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key") ) This option was called key() in syslog-ng OSE version 3.7. |
The destination is aimed at a fully controlled local, or near-local, trusted SMTP server. The goal is to send mail to trusted recipients, through a controlled channel. It hands mails over to an SMTP server, and that is all it does, therefore the resulting solution is as reliable as sending an e-mail in general. For example, syslog-ng OSE does not verify whether the recipient exists.
The smtp() driver sends e-mail messages triggered by log messages. The smtp() driver uses SMTP, without needing external applications. You can customize the main fields of the e-mail, add extra headers, send the e-mail to multiple recipients, and so on.
The subject(), body(), and header() fields may include macros which get expanded in the e-mail. For more information on available macros see Macros of syslog-ng OSE.
The smtp() driver has the following required parameters: host(), port(), from(), to(), subject(), and body(). For the list of available optional parameters, see smtp() destination options.
|
NOTE:
The smtp() destination driver is available only in |
smtp(host() port() from() to() subject() body() options());
The following example defines an smtp() destination using only the required parameters.
destination d_smtp { smtp( host("localhost") port(25) from("syslog-ng alert service" "noreply@example.com") to("Admin #1" "admin1@example.com") subject("[ALERT] Important log message of $LEVEL condition received from $HOST/$PROGRAM!") body("Hi!\nThe syslog-ng alerting service detected the following important log message:\n $MSG\n-- \nsyslog-ng\n") ); };
The following example sets some optional parameters as well.
destination d_smtp { smtp( host("localhost") port(25) from("syslog-ng alert service" "noreply@example.com") to("Admin #1" "admin1@example.com") to("Admin #2" "admin2@example.com") cc("Admin BOSS" "admin.boss@example.com") bcc("Blind CC" "blindcc@example.com") subject("[ALERT] Important log message of $LEVEL condition received from $HOST/$PROGRAM!") body("Hi!\nThe syslog-ng alerting service detected the following important log message:\n $MSG\n-- \nsyslog-ng\n") header("X-Program", "$PROGRAM") ); };
The following example sends an e-mail alert if the eth0 network interface of the host is down.
filter f_linkdown { match("eth0: link down" value("MESSAGE")); }; destination d_alert { smtp( host("localhost") port(25) from("syslog-ng alert service" "syslog@localhost") reply-to("Admins" "root@localhost") to("Ennekem" "me@localhost") subject("[SYSLOG ALERT]: eth0 link down") body("Syslog received an alert:\n$MSG") ); }; log { source(s_local); filter(f_linkdown); destination(d_alert); };
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center