systemd-journal() source options

The systemd-journal() driver has the following options:

default-facility()

Description: The default facility value if the SYSLOG_FACILITY entry does not exist.

default-level()

Description: The default level value if the PRIORITY entry does not exist.

host-override()

Description: Replaces the ${HOST} part of the message with the parameter string.

keep-hostname()

Description: Enable or disable hostname rewriting.

• If enabled (keep-hostname(yes)), syslog-ng PE will retain the hostname information read from the systemd journal messages.

• If disabled (keep-hostname(no)), syslog-ng PE will use the hostname that has been set up for the operating system instance that syslog-ng is running on. To query or set this value, use the hostnamectl command.

This option can be specified globally, and per-source as well. The local setting of the source overrides the global option if available.

log-fetch-limit()

Description: The maximum number of messages fetched from a source during a single poll loop. The destination queues might fill up before flow-control could stop reading if log-fetch-limit() is too high.

max-field-size()

Description: The maximum length of a field's value.

prefix()

Description: If this option is set, every non-built-in mapped names get a prefix (for example: ".SDATA.journald."). By default, syslog-ng PE adds the .journald. prefix to every value.

read-old-records()

Description: If set to yes, syslog-ng PE will start reading the records from the beginning of the journal, if the journal has not been read yet. If set to no, syslog-ng PE will read only the new records. If the source has a state in the persist file, this option will have no effect.

time-zone()

Description: The default timezone for messages read from the source. Applies only if no timezone is specified within the message itself.

The timezone can be specified as using the name of the (for example time-zone("Europe/Budapest")), or as the timezone offset in +/-HH:MM format (for example +01:00). On Linux and UNIX platforms, the valid timezone names are listed under the /usr/share/zoneinfo directory.

use-fqdn()

Description: Add Fully Qualified Domain Name instead of short hostname. This option can be specified globally, and per-source as well. The local setting of the source overrides the global option if available.

systemd-syslog: Collecting systemd messages using a socket

On platforms running systemd, the systemd-syslog() driver reads the log messages of systemd using the /run/systemd/journal/syslog socket. Note the following points about this driver:

• If possible, use the more reliable systemd-journal() driver instead.

• The socket activation of systemd is buggy, causing some log messages to get lost during system startup.

• If syslog-ng PE is running in a jail or a Linux Container (LXC), it will not read from the /dev/kmsg or /proc/kmsg files.

Declaration:

systemd-syslog();

@version: 7.0

source s_systemdd {
    systemd-syslog();
};

destination d_network {
    syslog("server.host");
};

log {
    source(s_systemdd);
    destination(d_network);
};

tcp, tcp6, udp, udp6: Collecting messages from remote hosts using the BSD syslog protocol

The tcp(), tcp6(), udp(), udp6() drivers can receive syslog messages conforming to RFC3164 from the network using the TCP and UDP networking protocols. The tcp6() and udp6() drivers use the IPv6 network protocol, while tcp() and udp() use IPv4.

To convert your existing tcp(), tcp6(), udp(), udp6() source drivers to use the network() driver, see Change an old source driver to the network() driver.

tcp(), tcp6(), udp() and udp6() source options — OBSOLETE

To convert your existing tcp(), tcp6(), udp(), udp6() source drivers to use the network() driver, see Change an old source driver to the network() driver.

Change an old source driver to the network() driver

To replace your existing tcp(), tcp6(), udp(), udp6() sources with a network() source, complete the following steps.

1. Replace the driver with network. For example, replace udp( with network(

2. Set the transport protocol.

   • If you used TLS-encryption, add the transport("tls") option, then continue with the next step.

   • If you used the tcp or tcp6 driver, add the transport("tcp") option.

   • If you used the udp or udp driver, add the transport("udp") option.

3. If you use IPv6 (that is, the udp6 or tcp6 driver), add the ip-protocol(6) option.

4. If you did not specify the port used in the old driver, check network() source options and verify that your clients send the messages to the default port of the transport protocol you use. Otherwise, set the appropriate port number in your source using the port() option.

5. All other options are identical. Test your configuration with the syslog-ng --syntax-only command.

   The following configuration shows a simple tcp source.

   source s_old_tcp {
       tcp(
           ip(127.0.0.1) port(1999)
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };

   When replaced with the network() driver, it looks like this.

   source s_new_network_tcp {
       network(
           transport("tls")
           ip(127.0.0.1) port(1999)
           tls(
               peer-verify("required-trusted")
               key-file("/opt/syslog-ng/etc/syslog-ng/syslog-ng.key")
               cert-file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt')
           )
       );
   };