syslog-ng Community

Blogs

  • What syslog-ng relays are good for

    While there are some users who run syslog-ng as a stand-alone application, the main strength of syslog-ng is central log collection. In this case the central syslog-ng instance is called the server, while the instances sending log messages to the cen...
    • 2832 Views
    • 2 Comments
  • Insider 2019-04: Tetris; Docker; Podman; python-fetcher

    Dear syslog-ng users, This is the 74th issue of syslog-ng Insider, a monthly newsletter that brings you news related to syslog-ng. NEWS Tetris destination In this blog post we show you a fun way of using the Python destination of syslog-ng. We will w...
    • 5026 Views
    • 0 Comments
  • Format your log messages in Python

    Getting log messages into the desired format can sometimes be a problem, but with syslog-ng you can use Python to get exactly the format you need. The syslog-ng Python template function allows you to write custom templates for syslog-ng in Python. It...
    • 2763 Views
    • 0 Comments
  • Tetris destination

    Tetris destination Tetris destination Table of Contents Overview The Emacs destination Inserting messages into an Emacs buffer Inserting messages outside Emacs The Tetris destination Overview In this blog post, I would like to show yo...
    • 585 Views
    • 1 Comments
  • Replacing Docker with Podman in the syslog-ng build container

    The syslog-ng source code includes a container-based build system. You can use it to generate source tarballs (the official syslog-ng release tarball is also generated this way) and to build packages for RHEL 7 and different Debian and Ubuntu release...
    • 1022 Views
    • 0 Comments
  • The syslog-ng python-fetcher(): collecting load average data

    Using python-fetcher() simplifies developing a source driver for syslog-ng even further. You do not have to implement your own eventloop, since syslog-ng does it for you. You only need to focus on what information you need and how you (or your code) ...
    • 379 Views
    • 0 Comments
  • Improved log collection over UDP

    “I'd tell you the joke about UDP, but you might not get it.” The old joke above perfectly summarizes UDP. There is no guarantee (frankly, not even a real effort) that data sent over UDP ever reaches the receiving end. Still, a surprisingl...
    • 330 Views
    • 0 Comments
  • Building and running a syslog-ng container using the latest tools

    I used containers (namely, FreeBSD jail) in production already in 2001. Still, it was the tool and company called Docker that made the use of containers mainstream. Fast forward another few years and you can hear the names skopeo, buildah and podman ...
    • 613 Views
    • 0 Comments
  • Creating an HTTP source for syslog-ng in Python

    HTTP is quickly becoming the universal transport protocol of the Internet. Nowadays even DNS over HTTPS implementations are available. There is no HTTP source implemented in C for syslog-ng, but starting with syslog-ng version 3.18, you can write new...
    • 868 Views
    • 1 Comments
  • Insider 2019-01: central server; survey; SNMP; Slack; Conferences & Webinars

    Dear syslog-ng users, This is the 72nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Creating a central syslog server Your home network might already contain some devices or systems like a home server, ...
    • 415 Views
    • 0 Comments
  • Send your log messages to Slack

    One of the many ways members of a team collaborate is to use Slack. From syslog-ng version 3.19, you can send log messages to Slack. You can receive critical log messages in real-time in your Slack client on your mobile or desktop. Learn how to set u...
    • 1182 Views
    • 0 Comments
  • Insider 2018-12: 3.19 release; optimizing Splunk; Python source; HTTP batch;

    Dear syslog-ng users, This is the 71st issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.19 of syslog-ng released Version 3.19 of syslog-ng has been released with plenty of new features and bugf...
    • 516 Views
    • 0 Comments
  • Installing the latest syslog-ng on Ubuntu and other DEB distributions

    As a follow-up to my RPM blog last week, here are instructions installing syslog-ng Open Source Edition (syslog-ng OSE) on the Debian / Ubuntu version. If you read my previous blog, skip to the installation part at the end, otherwise: read on. Update...
    • 17565 Views
    • 3 Comments
  • Installing latest syslog-ng on RHEL and other RPM distributions

    The syslog-ng application is included in all major Linux distributions, and you can usually install syslog-ng from the official repositories. If the core functionality of syslog-ng meets your needs, use the package in your distribution repository (yu...
    • 27072 Views
    • 0 Comments
  • Optimize your Splunk infrastructure using new syslog-ng features

    Learn how to use less resources for better performance in Splunk! Many people have been using syslog-ng for decades without knowing that it receives new features as well as bugfixes. While many Linux utilities are practically in maintenance mode, sys...
    • 2833 Views
    • 0 Comments
  • Using syslog-ng to forward SNMP traps to Splunk

    As we learned at the Splunk .conf18 this October, forwarding SNMP traps to Splunk can be a challenging task. Luckily, using syslog-ng can simplify it for us. All we need to make sure about is that snmptrapd logs traps to a file. The syslog-ng applica...
    • 1985 Views
    • 0 Comments
  • Analyze your Suricata logs in real-time using syslog-ng

    Last week I presented syslog-ng at SuriCon 2018 in Vancouver. In this blog post you can read a slightly modified version of that talk: a bit less emphasis on the introduction and a bit more on the explanation of the syslog-ng configuration part. The ...
    • 1930 Views
    • 0 Comments
  • Python source in syslog-ng

    Using syslog-ng 3.18 and newer releases, you can write new source drivers for syslog-ng in Python. While performance is not as good as C, you gain flexibility and ease of implementation. There are quite a few log sources without a ready to use C API,...
    • 1821 Views
    • 0 Comments
  • Insider 2018-10: 3.18 release; Splunk .conf18; Python destination; Python parser;

    Dear syslog-ng users, This is the 70th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Version 3.18 of syslog-ng released Version 3.18 of syslog-ng has been released with plenty of new features and bugf...
    • 1333 Views
    • 0 Comments
  • Bulk mode message sending to Elasticsearch with syslog-ng http() destination

    Learn how to send log messages in bulk mode to your Elasticsearch server with syslog-ng. Bulk mode offers better performance, because it sends multiple log messages in a single POST request. A few years back I wrote that any time a new language bind...
    • 2678 Views
    • 0 Comments
  • Small is beautiful: what's new in syslog-ng 3.18?

    Each syslog-ng release comes with one or more larger features that steal the show from very useful but smaller features. Now I collect these small features and explain how they can make your life easier. Learn what is coming up in syslog-ng version 3...
    • 1939 Views
    • 0 Comments
  • Parsing log messages with the syslog-ng Python parser

    The Python parser of syslog-ng not only enables you to parse any type of log message, but you can also use it to enrich messages. From this blog you will learn how to extract information from a specially formatted log message, and how to create new n...
    • 5445 Views
    • 0 Comments
  • Writing Python destination in syslog-ng: how to send log messages to MQTT

    In my past two Python blogs I introduced you to the basics of the syslog-ng Python destination. In this blog I show you a working example of how you can publish your logs to MQTT using the Python destination of syslog-ng. If you are new to the Python...
    • 2799 Views
    • 0 Comments
  • Insider 2018-09: SCL; Splunk .conf18; failover; human readable numbers; webinars;

    Dear syslog-ng users, This is the 69th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS Creating your first block for the syslog-ng configuration library (SCL) The syslog-ng configuration library (SCL) is...
    • 2233 Views
    • 0 Comments
  • Python destination: getting into details

    Last week you learned the very basics of the syslog-ng Python destination. This time, you will move a bit further and learn about a few more configuration options and optional methods. If you are new to the Python destination and want to get started ...
    • 2739 Views
    • 0 Comments