Event log messages collected by the Windows Event Collector for syslog-ng PE use this special source. To collect Windows event log messages, include this source in one of your source statements.
The Windows Event Collector tool for syslog-ng PE collects the log messages of Windows-based hosts in Unix datagram sockets, and then forwards them to a syslog-ng PE server over HTTPS (using TLS encryption and mutual authentication). syslog-ng PE reads the log messages using the windowsevent() source, and then parses the logs into key-value paris using the XML parser.
The XML parser uses the list-handling functionality to handle lists in the XML. Note that you cannot disable the list-handling functionality for the windowsevent() source.
For more information, see Windows Event Collector Administration Guide.
source s_wec { windowsevent( prefix(".windowsevent.") unix-domain-socket("`syslog-ng-root`/var/run/wec.sock") ); };
Starting with version 7.0.13, the syslog-ng PEwindowsevent() source can process XML arrays and make the elements of the arrays available as name-value pairs. For example, the following XML array becomes available as name-value pairs:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <EventID>5059</EventID> </System> <EventData> <Data Name="SubjectUserSid">S-1-5-18</Data> <Data Name="SubjectUserName">WIN-K1678A68SQ6$</Data> </EventData>
From the previous example, the following name-value pairs become available: ${Event.System.EventID} (5059), ${Event.EventData.SubjectUserSid} (S-1-5-18), ${Event.EventData.SubjectUserName} (WIN-K1678A68SQ6$).
The name-value pairs are only created from EventData.Data xml paths, that is, only for <Data> tags that are the children of an <EventData> tag and have the Name attribute.
If the array-like structure is not a Data tag under EventData tag, or it misses the Name attribute, then the regular XML-parser logic is used.
The windowsevent() driver has the following options:
Type: | string |
Default: | ".windowsevent." |
Description: The prefix that you wish to append to the key-value pairs.
If you want to send Windows event logs to SDATA, then set prefix(".SDATA."). This can be useful, for example, when you forward Windows event logs to a syslog-ng Store Box.
Type: | string |
Default: | /opt/syslog-ng/var/run/wec.sock |
Description: The path to the Unix domain socket to read messages from.
A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.
If no drivers are defined for a destination, all messages sent to the destination are discarded. This is equivalent to omitting the destination from the log statement.
To define a destination, add a destination statement to the syslog-ng configuration file using the following syntax.
destination <identifier> { destination-driver(params); destination-driver(params); ... };
The following destination statement sends messages to the TCP port 1999 of the 10.1.2.3 host.
destination d_demo_tcp { network("10.1.2.3" port(1999)); };
If name resolution is configured, you can use the hostname of the target server as well.
destination d_tcp { network("target_host" port(1999)); };
|
Caution:
|
The following table lists the destination drivers available in syslog-ng PE.
Name | Description |
---|---|
elasticsearch-http() | Sends messages to an Elasticsearch server over HTTP using its REST API. |
file() | Writes messages to the specified file. |
graphite() | Sends metrics to a Graphite server to store numeric time-series data. |
hdfs() | Sends messages into a file on a Hadoop Distributed File System (HDFS) or MapR-FS node. |
http() | Sends messages over the HTTP protocol. |
kafka() | Publishes log messages to the Apache Kafka message bus, where subscribers can access them. |
logstore() | Writes messages securely into encrypted, compressed, and timestamped binary files. |
mongodb() | Sends messages to a MongoDB database. |
network() | Sends messages to a remote host using the BSD-syslog protocol over IPv4 and IPv6. Supports the TCP, UDP, ALTP, and TLS network protocols. |
pipe() | Writes messages to the specified named pipe. |
program() | Forks and launches the specified program, and sends messages to its standard input. |
python() | Send messages to a custom destination written in Python. |
smtp() | Sends email messages to the specified recipients. |
splunk-hec() | Forward your log messages to Splunk. |
sql() | Sends messages into an SQL database. In addition to the standard syslog-ng packages, the sql() destination requires database-specific packages to be installed. Refer to the section appropriate for your platform in Installing syslog-ng. |
syslog() | Sends messages to the specified remote host using the IETF-syslog protocol. The IETF standard supports message transport using the UDP, TCP, and TLS networking protocols. |
syslog-ng() | The syslog-ng() destination driver forwards log messages to another syslog-ng node in EWMM format. |
unix-dgram() | Sends messages to the specified unix socket in SOCK_DGRAM style (BSD). |
unix-stream() | Sends messages to the specified unix socket in SOCK_STREAM style (Linux). |
usertty() | Sends messages to the terminal of the specified user, if the user is logged in. |
|
Caution:
This destination is deprecated and will be removed from a future version of syslog-ng PE. We recommend using the elasticsearch-http: Sending messages to Elasticsearch HTTP Event Collector destination instead. |
Starting with version
NOTE: To use this destination, syslog-ng PE must run in server mode. Typically, only the central syslog-ng PE server uses this destination. For more information on the server mode, see Server mode.
Note the following limitations when using the syslog-ng PE elasticsearch2 destination:
This destination is only supported on the Linux platforms that use the linux glibc2.11 installer, including: Red Hat ES 7, Ubuntu 14.04 (Trusty Tahr).
Since syslog-ng PE uses Java libraries, the elasticsearch2 destination has significant memory usage.
The log messages of the underlying client libraries are available in the internal() source of syslog-ng PE.
@module mod-java @include "scl.conf" elasticsearch2( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("test") cluster("syslog-ng") );
The following example defines an elasticsearch2 destination that sends messages in transport mode to an Elasticsearch server running on the localhost, using only the required parameters.
@module mod-java @include "scl.conf" destination d_elastic { elasticsearch2( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("test") ); };
The following example sends 10000 messages in a batch, in transport mode, and includes a custom unique ID for each message.
@module mod-java @include "scl.conf" options { threaded(yes); use-uniqid(yes); }; source s_syslog { syslog(); }; destination d_elastic { elasticsearch2( index("syslog-ng_${YEAR}.${MONTH}.${DAY}") type("test") cluster("syslog-ng") client-mode("transport") custom-id("${UNIQID}") flush-limit("10000") ); }; log { source(s_syslog); destination(d_elastic); flags(flow-control); };
The following example send messages to Elasticsearch over HTTP using its REST API:
@include "scl.conf" source s_network { network(port(5555)); }; destination d_elastic { elasticsearch2( client-mode("http") cluster("es-syslog-ng") index("x201") cluster-url("http://192.168.33.10:9200") type("slng_test_type") flush-limit("0") ); }; log { source(s_network); destination(d_elastic); flags(flow-control); };
To install the software required for the elasticsearch2 destination, see Prerequisites.
For details on how the elasticsearch2 destination works, see How syslog-ng PE interacts with Elasticsearch.
For the list of options, see Elasticsearch2 destination options (DEPRECATED).
If you delete all Java destinations from your configuration and reload syslog-ng, the JVM is not used anymore, but it is still running. If you want to stop JVM, stop syslog-ng and then start syslog-ng again.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback 使用条款 隐私