syslog-ng Open Source Edition 3.18 - Administration Guide

Declaration:

@module mod-java

java(
    class-path("/syslog-ng/install_dir/lib/syslog-ng/java-modules/*.jar")
    class-name("org.syslog_ng.http.HTTPDestination")

    option("url", "http://<server-address>:<port-number>")

);

Required options:

The following options are required: url(). Note that to use http, you must add the following line to the beginning of your syslog-ng OSE configuration:

@module mod-java

class-name()

Description: The name of the class (including the name of the package) that includes the destination driver to use.

For the http destination, use this option as class-name("org.syslog_ng.http.HTTPDestination").

client-lib-dir()

Description: The list of the paths where the required Java classes are located. For example, class-path("/opt/syslog-ng/lib/syslog-ng/java-modules/:/opt/my-java-libraries/libs/"). If you set this option multiple times in your syslog-ng OSE configuration (for example, because you have multiple Java-based destinations), syslog-ng OSE will merge every available paths to a single list.

For the http destination, include the path to the java modules of syslog-ng OSE, for example, class-path("/syslog-ng/install_dir/lib/syslog-ng/java-modules/*.jar").

method()

Description: Specifies the HTTP method to use when sending the message to the server. Available in syslog-ng OSE version 3.7.2 and newer.

url()

Description: Specifies the hostname or IP address and optionally the port number of the web service that can receive log data via HTTP. Use a colon (:) after the address to specify the port number of the server. You can also use macros, templates, and template functions in the URL, for example: http://host.example.com:8080/${MACRO1}/${MACRO2}/script")

Declaration:

destination d_http {
    http(
        url("<web-service-IP-or-hostname>")
        method("<HTTP-method>")
        user-agent("<USER-AGENT-message-value>")
        user("<username>")
        password("<password>")
    );
};

Batch mode

Starting with version 3.18, you can send multiple log messages in a single HTTP request if the destination HTTP server supports that.

value of body-prefix() option
log-line-1 (as formatted in the body() option)
log-line-2 (as formatted in the body() option)
....
log-line-n (the number of log lines is flush-lines(), or less if flush-timeout() has elapsed or the batch would be longer than flush-bytes())
value of body-suffix() option

destination d_http {
    http(url("http://your-elasticsearch-server/_bulk")
        method("POST")
        flush-lines(100)
        flush-bytes(512Kb)
        flush-timeout(10000)
        headers("Content-Type: application/x-ndjson")
        body-suffix("\n")
        body('{ "index":{} }
             $(format-json --scope rfc5424 --key ISODATE)')
    );
};

body()

Description: The body of the HTTP request, for example, body("${ISODATE} ${MESSAGE}"). You can use strings, macros, and template functions in the body. If not set, it will contain the message received from the source by default.

body-prefix()

Description: The string syslog-ng OSE puts at the beginning of the body of the HTTP request, before the log message. Available in syslog-ng OSE version 3.18 and later.

For details on how this option influences HTTP batch mode, see Batch mode

body-suffix()

Description: The string syslog-ng OSE puts to the end of the body of the HTTP request, after the log message. Available in syslog-ng OSE version 3.18 and later.

For details on how this option influences HTTP batch mode, see Batch mode

ca-file()

Description: Name of a file that contains an X.509 CA certificate (or a certificate chain) in PEM format. The syslog-ng OSE application uses this certificate to validate the certificate of the HTTPS server. If the file contains a certificate chain, the file must begin with the certificate of the host, followed by the CA certificate that signed the certificate of the host, and any other signing CAs in order.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

cert-file()

Description: Name of a file, that contains an X.509 certificate (or a certificate chain) in PEM format, suitable as a TLS certificate, matching the private key set in the key-file() option. The syslog-ng OSE application uses this certificate to authenticate the syslog-ng OSE client on the destination server. If the file contains a certificate chain, the file must begin with the certificate of the host, followed by the CA certificate that signed the certificate of the host, and any other signing CAs in order.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

cipher-suite()

Description: Specifies the cipher, hash, and key-exchange algorithms used for the encryption, for example, ECDHE-ECDSA-AES256-SHA384. The list of available algorithms depends on the version of OpenSSL used to compile syslog-ng OSE. To specify multiple ciphers, separate the cipher names with a colon, and enclose the list between double-quotes, for example:

cipher-suite("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384")

For a list of available algorithms, execute the openssl ciphers -v command. The first column of the output contains the name of the algorithms to use in the cipher-suite() option, the second column specifies which encryption protocol uses the algorithm (for example, TLSv1.2). That way, the cipher-suite() also determines the encryption protocol used in the connection: to disable SSLv3, use an algorithm that is available only in TLSv1.2, and that both the client and the server supports. You can also specify the encryption protocols using ssl-options().

You can also use the following command to automatically list only ciphers permitted in a specific encryption protocol, for example, TLSv1.2:

echo "cipher-suite(\"$(openssl ciphers -v | grep TLSv1.2 | awk '{print $1}' | xargs echo -n | sed 's/ /:/g' | sed -e 's/:$//')\")"

Note that starting with version 3.10, when syslog-ng OSE receives TLS-encrypted connections, the order of ciphers set on the syslog-ng OSE server takes precedence over the client settings.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

delimiter()

Description: By default, syslog-ng OSE separates the log messages of the batch with a newline character. You can specify a different delimiter by using the delimiter() option. Available in syslog-ng OSE version 3.18 and later.

For details on how this option influences HTTP batch mode, see Batch mode

flush-bytes()

Description: Sets the maximum size of payload in an HTTP batch. If the size of the messages reaches this value, syslog-ng OSE sends the batch to the destination even if there are less messages in than set in the flush-lines() option. Available in syslog-ng OSE version 3.18 and later.

For details on how this option influences HTTP batch mode, see Batch mode

flush-lines()

Description: Specifies how many lines are flushed to a destination at a time. The syslog-ng OSE application waits for this number of lines to accumulate and sends them off in a single batch. Increasing this number increases throughput as more messages are sent in a single batch, but also increases message latency.

The syslog-ng OSE application flushes the messages if it has sent flush-lines() number of messages, or the queue became empty. If you stop or reload syslog-ng OSE or in case of network sources, the connection with the client is closed, syslog-ng OSE automatically sends the unsent messages to the destination.

For optimal performance when sending messages to an syslog-ng OSE server, make sure that the flush-lines() is smaller than the window size set using the log-iw-size() option in the source of your server.

For details on how this option influences HTTP batch mode, see Batch mode

flush-timeout()

Description: Specifies the time syslog-ng OSE waits for lines to accumulate in the output buffer. The syslog-ng OSE application sends flushes to the destinations evenly. The timer starts when the first message arrives to the buffer, so if only few messages arrive, syslog-ng OSE sends messages to the destination at most once every flush-timeout() seconds.

For details on how this option influences HTTP batch mode, see Batch mode

headers()

Description: Custom HTTP headers to include in the request, for example, headers("HEADER1: header1", "HEADER2: header2"). If not set, only the default headers are included, but no custom headers.

The following headers are included by default:

• X-Syslog-Host: <host>

• X-Syslog-Program: <program>

• X-Syslog-Facility: <facility>

• X-Syslog-Level: <loglevel/priority>

key-file()

Description: The name of a file that contains an unencrypted private key in PEM format, suitable as a TLS key. If properly configured, the syslog-ng OSE application uses this private key and the matching certificate (set in the cert-file() option) to authenticate the syslog-ng OSE client on the destination server.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

method()

Description: Specifies the HTTP method to use when sending the message to the server.

password()

Description: The password that syslog-ng OSE uses to authenticate on the server where it sends the messages.

peer-verify()

Description: Verification method of the peer. The following table summarizes the possible options and their results depending on the certificate of the peer.

For untrusted certificates only the existence of the certificate is checked, but it does not have to be valid — syslog-ng accepts the certificate even if it is expired, signed by an unknown CA, or its CN and the name of the machine mismatches.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

retries()

Description: The number of times syslog-ng OSE attempts to send a message to this destination. If syslog-ng OSE could not send a message, it will try again until the number of attempts reaches retries, then drops the message.

To handle HTTP error responses, if the HTTP server returns 5xx codes, syslog-ng OSE will attempt to resend messages until the number of attempts reaches retries. If the HTTP server returns 4xx codes, syslog-ng OSE will drop the messages.

ssl-version()

Description: Specifies the permitted SSL/TLS version. Possible values: sslv2, sslv3, tlsv1, tlsv1_0, tlsv1_1, tlsv1_2.

An alternative way to specify this option is to put into a tls() block and specify it there, together with any other TLS options. This allows you to separate these options and ensure better readability.

Declaration:

destination  d_http {
	http(
		url("http://127.0.0.1:8080")
		tls(
			ca-dir("dir")
			ca-file("ca")
			cert-file("cert")
			cipher-suite("cipher") 
			key-file("key")
			peer-verify(yes|no)
			ssl-version(<the permitted SSL/TLS version>)
		)
	);
};

Make sure that you specify TLS options either using their own dedicated option (ca-dir(), ca-file(), cert-file(), cipher-suite(), key-file(), peer-verify(), and ssl-version()), or using the tls() block and inserting the relevant options within tls(). Avoid mixing the two methods. In case you do specify TLS options in both ways, the one that comes later in the configuration file will take effect.

timeout()

Description: The value (in seconds) to wait for an operation to complete, and attempt to reconnect the server if exceeded. By default, the timeout value is 0, meaning that there is no timeout. Available in version 3.11 and later.

url()

Description: Specifies the hostname or IP address and optionally the port number of the web service that can receive log data via HTTP. Use a colon (:) after the address to specify the port number of the server. For example: http://127.0.0.1:8000

user-agent()

Description: The value of the USER-AGENT header in the messages sent to the server.

user()

Description: The username that syslog-ng OSE uses to authenticate on the server where it sends the messages.

workers()

Description: Specifies the number of worker threads (at least 1) that syslog-ng OSE uses to send messages to the HTTP server. Increasing the number of worker threads can drastically improve the performance of the destination.