NAME

syslog-ng.conf - {{ site.product.short_name }} configuration file

SYNOPSIS

syslog-ng.conf

DESCRIPTION

This manual page is only an abstract.

The syslog-ng OSE application is a flexible and highly scalable system logging application. Typically, syslog-ng OSE is used to manage log messages and implement centralized logging, where the aim is to collect the log messages of several devices on a single, central log server. The different devices - called syslog-ng OSE clients - all run syslog-ng OSE, and collect the log messages from the various applications, files, and other sources. The clients send all important log messages to the remote syslog-ng OSE PE server, where the server sorts and stores them.

BASIC CONCEPTS OF syslog-ng OSE

The syslog-ng OSE application reads incoming messages and forwards them to the selected destinations. The syslog-ng OSE application can receive messages from files, remote hosts, and other sources.

Log messages enter syslog-ng OSE in one of the defined sources, and are sent to one or more destinations.

Sources and destinations are independent objects, log paths define what syslog-ng OSE does with a message, connecting the sources to the destinations. A log path consists of one or more sources and one or more destinations: messages arriving from a source are sent to every destination listed in the log path. A log path defined in syslog-ng OSE is called a log statement.

Optionally, log paths can include filters. Filters are rules that select only certain messages, for example, selecting only messages sent by a specific application. If a log path includes filters, syslog-ng OSE sends only the messages satisfying the filter rules to the destinations set in the log path.

Other optional elements that can appear in log statements are parsers and rewriting rules. Parsers segment messages into different fields to help processing the messages, while rewrite rules modify the messages by adding, replacing, or removing parts of the messages.

CONFIGURING syslog-ng OSE

type-of-the-object identifier-of-the-object {<parameters>};

source s_internal { internal(); };

log { source(s_internal); destination(d_file); };

option(parameter1, parameter2); option2(parameter1, parameter2);

source s_tail { file("/var/log/apache/access.log"
follow-freq(1) flags(no-parse, validate-utf8)); };

source s_demo_stream1 {


    unix-stream("<path-to-socket>" 


    max-connections(10) group(log)); 
};
source s_demo_stream2 {


    unix-stream("<path-to-socket>" 


    group(log) max-connections(10)); 
};

options { use-dns(no); };

# Comment: This is a stream source
source s_demo_stream {
unix-stream("<path-to-socket>" max-connections(10) group(log)); };

The syntax of log statements is as follows:

log {


    source(s1); source(s2); ...


    optional_element(filter1|parser1|rewrite1);


    optional_element(filter2|parser2|rewrite2);


    ...


    destination(d1); destination(d2); ...


    flags(flag1[, flag2...]);
};

The following log statement sends all messages arriving to the localhost to a remote server.

source s_localhost { network(ip(127.0.0.1) port(1999)); };
destination d_tcp { network("10.1.2.3" port(1999) localport(999)); };
log { source(s_localhost); destination(d_tcp); };

The syslog-ng OSE application has a number of global options governing DNS usage, the timestamp format used, and other general points. Each option may have parameters, similarly to driver specifications. To set global options add an option statement to the syslog-ng OSE configuration file using the following syntax:

options { option1(params); option2(params); ... };

For example:

To disable domain name resolving, add the following line to the syslog-ng OSE configuration file:

options { use-dns(no); };

The sources, destinations, and filters available in syslog-ng OSE are listed below.

TABLE 1: SOURCE DRIVERS AVAILABLE IN syslog-ng OSE

TABLE 2: DESTINATION DRIVERS AVAILABLE IN syslog-ng OSE

TABLE 3: FILTER FUNCTIONS AVAILABLE IN syslog-ng OSE

FILES

/Users/hofi/Develop/Balabit/syslog-ng/build/install/

/Users/hofi/Develop/Balabit/syslog-ng/build/install/etc/syslog-ng.conf

NOTE: If you experience any problems or need help with syslog-ng OSE, see the syslog-ng OSE Administration Guide[1], or visit the syslog-ng OSE mailing list[2]. For news and notifications about syslog-ng OSE, visit the syslog-ng OSE blogs[3].

AUTHOR

This manual page was generated from the syslog-ng OSE Administration Guide[1], which was written by several contributors to whom we'd like to extend our sincere thanks.

COPYRIGHT

NOTES

[1] syslog-ng OSE Administration Guide
⟨https://syslog-ng.github.io/admin-guide/README⟩

[2] syslog-ng OSE mailing list
⟨https://lists.balabit.hu/mailman/listinfo/syslog-ng⟩

[3] syslog-ng OSE blogs
⟨https://syslog-ng.com/blog/⟩