Skip to content

syslog_forwarder job from syslog/12.0.4

Github source: 63dc7a9 or master branch

Properties

logging

format

timestamp

Format for timestamp in log file forwarder logs. Valid values are ‘deprecated’ and ‘rfc3339’.

Default
deprecated

syslog

address

IP or DNS address of the syslog server.

Example
logs4.papertrail.com

blackbox

limit_cpu

limit goprocess to a single cpu via gomaxprocs

Default
true
log_filename

If set to true, log lines are also tagged with filename in the format /.

Default
false
source_dir

directory with subdirectories containing log files. log lines will be tagged with subdirectory name.

Default
/var/vcap/sys/log

ca_cert

Trusted CAs. Necessary if TLS / mTLS is enabled AND signing CA is not present in instance cert store. Overrides instance cert store if set.

Example
|+
  -----BEGIN CERTIFICATE-----
  MIIClTCCAf4CCQDc6hJtvGB8RjANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMC...
  -----END CERTIFICATE-----

client_cert

Client certificate for syslog forwarding over mTLS

client_key

Client key for syslog forwarding over mTLS

custom_rule

Custom rsyslog rule for event forwarder. This will be inserted before the forwarding rule. See further discussion and examples in example-custom-rules.md at the top level of the release repo.

Default
""

director

BOSH Director name

Default
""

fallback_servers

List of fallback servers to be used if the primary syslog server is down. Only tcp or relp protocols are supported. Each list entry should consist of “address”, “transport” and “port” keys.

Default
[]
Example
- address: logs5.papertrail.com
  port: 44312
  transport: tcp

filter_legacy_vcap_messages

Drop messages with an app name that starts with “vcap.” This is intended to prevent near-identical duplicates when using forward_files with legacy Cloud Foundry jobs, which generally use tee to send logs to syslog directly in addition to writing them to the filesystem. This should probably be set to true in any deployment of Cloud Foundry Application Runtime. This may be on by default in the future, though this would be a breaking/major version change.

Default
false

forward_files

If enabled, use BlackBox to forward logs.

Default
true

heuristically_filter_debug_messages

Drop messages with an msg that start with “DEBUG”. This is intended to prevent high-volume, low-value debug logs from overwhelming syslog receivers, while still allowing the UAA job to log its debug messages to disk for support-enablement purposes. While this may impact other logs, most other jobs are not generally configured to emit debug logs, and anyone who wants to filter out UAA’s debug volume likely doesn’t mind losing the other debug volume, too. This filter is necessarily heuristic/string-based because syslog PRI information is not meaningful in logs produced by blackbox.

Default
false

max_message_size

Sets the $MaxMessageSize configuration flag for rsyslog.

Default
8k

migration

disabled

Deprecated. Allows systems that cannot modify their deployment topology to use this release. Do not use if you’re not already relying on this capability. If true, does not forward syslogs, and does not require any other properties be provided. Overrides all other configuration.

Default
false

permitted_peer

Accepted fingerprint (SHA1) or name of remote peer. Only used if TLS is enabled. If not specified, will use the configured forwarding address.

Example
'*.papertrail.com'

port

Port of the syslog server.

Default
514

queue_checkpoint_interval

write bookkeeping information on checkpoints (every n records)

Default
100

queue_discard_mark

After this number of messages are queued, purge messages whose severity is greater than or equal to DiscardSeverity.

Default
97500

queue_discard_severity

This discards queued messages of this severity or higher when the queue_discard_mark is reached. Setting this to ‘0’ will discard all queued messages when the queue_discard_mark is reached.

Default
0

queue_file_name

Spill to disk if queue is full.

Default
agg_backlog

queue_high_water_mark

Num messages. Assuming avg size of 512B, this is 4MiB. (If this is reached, messages will spill to disk until the low watermark is reached).

Default
80000

queue_low_water_mark

Number of messages. Assuming avg size of 512B, this is 1MiB.

Default
2000

queue_max_disk_space

Max size for disk queue.

Default
128m

queue_save_on_shutdown

Save in-memory data to disk if rsyslog shuts down. Must be “on” or “off”

Default
true

queue_size

Store no more than this number syslog messages in memory.

Default
100000

queue_timeout_enqueue

Discard messages if the queue + disk is full

Default
0

respect_file_permissions

If enabled, log files will be forwarded if and only if they satisfy any of the following: - world-readable - readable by the syslog user - readable by the vcap group (note: the vcap user is insufficient, it must be the group.)

Default
false

resume_interval

When action is suspended (dest not connected), retry after this number of seconds

Default
10

tls_enabled

Set this to true to enable TLS / mTLS.

Default
false

transport

One of udp, tcp, relp.

Default
tcp

use_tcp_for_file_forwarding_local_transport

If enabled, Blackbox will use TCP rather than UDP when forwarding loglines from files to the local rsyslog. Does not affect forwarding to remote addresses. This prevents truncation of log lines over 1KB, but may have undesirable performance impact.

Default
false

Templates

Templates are rendered and placed onto corresponding instances during the deployment process. This job's templates will be placed into /var/vcap/jobs/syslog_forwarder/ directory (learn more).

  • bin/blackbox_ctl (from blackbox_ctl.erb)
  • bin/drain (from drain.erb)
  • bin/pre-start (from pre-start.erb)
  • config/blackbox_config.yml (from blackbox_config.yml.erb)
  • config/ca_cert.pem (from ca_cert.pem.erb)
  • config/client.crt (from client.crt.erb)
  • config/client.key (from client.key.erb)
  • config/syslog-release-custom-rules.conf (from syslog-release-custom-rules.conf.erb)
  • config/syslog-release-debug-filter.conf (from syslog-release-debug-filter.conf.erb)
  • config/syslog-release-file-exclusion.conf (from syslog-release-file-exclusion.conf.erb)
  • config/syslog-release-forwarding-rules.conf (from syslog-release-forwarding-rules.conf.erb)
  • config/syslog-release-forwarding-setup.conf (from syslog-release-forwarding-setup.conf.erb)
  • config/syslog-release-vcap-filter.conf (from syslog-release-vcap-filter.conf.erb)
  • config/syslog-release.conf (from syslog-release.conf.erb)

Packages

Packages are compiled and placed onto corresponding instances during the deployment process. Packages will be placed into /var/vcap/packages/ directory.