Chapter 3 - Additional Features
User Guide
259
Some Examples of Defining Sources
1) To read from a file:
source <identifier> {file(filename);};
Example to read messages from “/temp/file1” file:
source file1 {file(‘/temp/file1’);};
Example to receive messages from the kernel:
source s_kernel { file(‘/proc/kmsg’); };
2) To receive messages from local syslogd clients:
source sysl {unix-stream(‘/dev/log’);};
3) To receive messages from remote syslogd clients:
source s_udp { udp(ip(<cliente ip>) port(<udp port>)); };
Example to listen to messages from all machines on UDP port 514:
source s_udp { udp(ip(0.0.0.0) port(514));};
c) tcp([options])
and
udp([options])
These drivers let you receive messages from the network, and as
the name of the drivers show, you can use both TCP and UDP.
None of tcp() and udp() drivers require positional parameters. By
default they bind to 0.0.0.0:514, which means that syslog-ng will
listen on all available interfaces.
Options:
ip(<ip address>)
- The IP address to bind to. Default: 0.0.0.0.
port(<number>)
- UDP/TCP port used to listen messages.
Default: 514.
max-connections(n)
- Limits the number of simultaneously
opened connections. Default: 10.
d) file(filename)
Opens the specified file and reads messages.
e) pipe(filename)
Opens a named pipe with the specified name, and listens for
messages. (You'll need to create the pipe using mkfifo
command).
