Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.

NOTE: The syslog-ng PE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng PE to execute external applications.

Using the hook-commands() when syslog-ng PE starts or stops

To execute an external program when syslog-ng PE starts or stops, use the following options:

startup()
Type: string
Default: N/A

Description: Defines the external program that is executed when syslog-ng PE starts.

shutdown()
Type: string
Default: N/A

Description: Defines the external program that is executed when syslog-ng PE stops.
Using the hook-commands() when syslog-ng PE reloads

To execute an external program when the syslog-ng PE configuration is initiated or torn down (for example, on startup/shutdown or during a syslog-ng PE reload), use the following options:

setup()
Type: string
Default: N/A

Description: Defines an external program that is executed when the syslog-ng PE configuration is initiated, for example, on startup or during a syslog-ng PE reload.
teardown()
Type: string
Default: N/A

Description: Defines an external program that is executed when the syslog-ng PE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng PE reload.
Example: Using the hook-commands() with a network source

In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically when syslog-ng PE is started/stopped.

The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng PE created rule is there, packets can flow (otherwise the port is closed).

source {
  network(transport(udp)
    hook-commands(
      startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
      shutdown("iptables -D LOGCHAIN 1")
    ;)
  );
};