dom
/
telegraf
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update syslog documentation

This commit is contained in:
Daniel Nelson 2018-10-01 16:01:18 -07:00
parent a63c0dda94
commit 5ec50b28ed
No known key found for this signature in database
GPG Key ID: CAAD59C9444F6155
1 changed files with 38 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
plugins/inputs/syslog/README.md
View File

@ -75,6 +75,18 @@ $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
# forward over tcp with octet framing according to RFC 5425
*.* @@(o)127.0.0.1:6514;RSYSLOG_SyslogProtocol23Format
# uncomment to use udp according to RFC 5424
#*.* @127.0.0.1:6514;RSYSLOG_SyslogProtocol23Format
```
You can alternately use `advanced` format (aka RainerScript):
```
# forward over tcp with octet framing according to RFC 5425
action(type="omfwd" Protocol="tcp" TCP_Framing="octet-counted" Target="127.0.0.1" Port="6514" Template="RSYSLOG_SyslogProtocol23Format")
# uncomment to use udp according to RFC 5424
#action(type="omfwd" Protocol="udp" Target="127.0.0.1" Port="6514" Template="RSYSLOG_SyslogProtocol23Format")
```
To complete TLS setup please refer to [rsyslog docs](https://www.rsyslog.com/doc/v8-stable/tutorials/tls.html).
@ -91,18 +103,40 @@ To complete TLS setup please refer to [rsyslog docs](https://www.rsyslog.com/doc
- version (integer)
- severity_code (integer)
- facility_code (integer)
- timestamp (integer)
- timestamp (integer): the time recorded in the syslog message
- procid (string)
- msgid (string)
- sdid (bool)
- *Structured Data* (string)
- timestamp: the time the messages was received
#### Structured Data
Structured data produces field keys by combining the `SD_ID` with the `PARAM_NAME` combined using the `sdparam_separator` as in the following example:
```
170 <165>1 2018-10-01:14:15.000Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry...
```
```
syslog,appname=evntslog,facility=local4,hostname=mymachine.example.com,severity=notice exampleSDID@32473_eventID="1011",exampleSDID@32473_eventSource="Application",exampleSDID@32473_iut="3",facility_code=20i,message="An application event log entry...",msgid="ID47",severity_code=5i,timestamp=1065910455003000000i,version=1i 1538421339749472344
```
### Troubleshooting
The syslog plugin does not yet support RFC3164 format data. You may see the following error when this syslog format is received:
``
You can send debugging messages directly to the input plugin using netcat:
```sh
# TCP with octet framing
echo "57 <13>1 2018-10-01T12:00:00.0Z example.org root - - - test" | nc 127.0.0.1 6514
# UDP
echo "<13>1 2018-10-01T12:00:00.0Z example.org root - - - test" | nc -u 127.0.0.1 6514
```
#### RFC3164
RFC3164 encoded messages are not currently supported. You may see the following error if a message encoded in this format:
```
E! Error in plugin [inputs.syslog]: expecting a version value in the range 1-999 [col 5]
```
You can use rsyslog to translate RFC3164 syslog messages to RFC5424 or RFC5425 format.
You can use rsyslog to translate RFC3164 syslog messages into RFC5424 format.