syslog-ng Open Source Edition 3.16 - Administration Guide

tcp(), tcp6(), udp() and udp6() source options: OBSOLETE

To convert your existing tcp(), tcp6(), udp(), udp6() source drivers to use the network() driver, see Change an old source driver to the network() driver.

Change an old source driver to the network() driver

To replace your existing tcp(), tcp6(), udp(), udp6() sources with a network() source, complete the following steps.

1. Replace the driver with network. For example, replace udp( with network(

2. Set the transport protocol.

   • If you used TLS-encryption, add the transport("tls") option, then continue with the next step.

   • If you used the tcp or tcp6 driver, add the transport("tcp") option.

   • If you used the udp or udp driver, add the transport("udp") option.

3. If you use IPv6 (that is, the udp6 or tcp6 driver), add the ip-protocol(6) option.

4. If you did not specify the port used in the old driver, check network() source options and verify that your clients send the messages to the default port of the transport protocol you use. Otherwise, set the appropriate port number in your source using the port() option.

5. All other options are identical. Test your configuration with the syslog-ng --syntax-only command.

   The following configuration shows a simple tcp source.

   source s_old_tcp {
       tcp(
           ip(127.0.0.1) port(1999)
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };

   When replaced with the network() driver, it looks like this.

   source s_new_network_tcp {
       network(
           transport("tls")
           ip(127.0.0.1) port(1999)
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };

unix-stream, unix-dgram: Collecting messages from UNIX domain sockets

The unix-stream() and unix-dgram() drivers open an AF_UNIX socket and start listening on it for messages. The unix-stream() driver is primarily used on Linux and uses SOCK_STREAM semantics (connection oriented, no messages are lost), while unix-dgram() is used on BSDs and uses SOCK_DGRAM semantics: this may result in lost local messages if the system is overloaded.

To avoid denial of service attacks when using connection-oriented protocols, the number of simultaneously accepted connections should be limited. This can be achieved using the max-connections() parameter. The default value of this parameter is quite strict, you might have to increase it on a busy system.

Both unix-stream and unix-dgram have a single required argument that specifies the filename of the socket to create. For the list of available optional parameters, see unix-stream() and unix-dgram() source options

unix-stream(filename [options]);
unix-dgram(filename [options]);

source s_stream {
    unix-stream("/dev/log" max-connections(10));
};

source s_dgram {
    unix-dgram("/var/run/log");
};

UNIX credentials and other metadata

Starting with syslog-ng OSE 3.6, the unix-stream() and unix-dgram() sources automatically extract the available UNIX credentials and other metainformation from the received log messages. The syslog-ng OSE application can extract the following information on Linux and FreeBSD platforms (examples show the value of the macro for the su - myuser command). Similar information is available for the systemd-journal source.