Skip to content

syslog_forwarder job from syslog/7

Github source: 8e3ce3ac or master branch

Properties

syslog

address

IP or DNS address of the syslog server.

Example
logs4.papertrail.com

ca_cert

Trust these Certificate Authorities. Required if TLS is enabled.

Example
|+
  -----BEGIN CERTIFICATE-----
  MIIClTCCAf4CCQDc6hJtvGB8RjANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMC...
  -----END CERTIFICATE-----

custom_rule

Custom rule for syslog event forwarder.

Default
""

fallback_servers

List of fallback servers to be used if the primary syslog server is down. Only tcp or relp protocols are supported. Each list entry should consist of “address”, “transport” and “port” keys.

Default
[]
Example
- address: logs5.papertrail.com
  port: 44312
  transport: tcp

permitted_peer

Accepted fingerprint (SHA1) or name of remote peer. Required if TLS is enabled.

Default
""
Example
'*.papertrail.com'

port

Port of the syslog server.

Default
514

queue_checkpoint_interval

write bookkeeping information on checkpoints (every n records)

Default
100

queue_discard_mark

After this number of messages are queued, purge messages whose severity is greater than or equal to DiscardSeverity.

Default
97500

queue_discard_severity

This discards queued messages of this severity or higher when the queue_discard_mark is reached. Setting this to ‘0’ will discard all queued messages when the queue_discard_mark is reached.

Default
0

queue_file_name

Spill to disk if queue is full.

Default
agg_backlog

queue_high_water_mark

Num messages. Assuming avg size of 512B, this is 4MiB. (If this is reached, messages will spill to disk until the low watermark is reached).

Default
80000

queue_low_water_mark

Number of messages. Assuming avg size of 512B, this is 1MiB.

Default
2000

queue_max_disk_space

Max size for disk queue.

Default
128m

queue_save_on_shutdown

Save in-memory data to disk if rsyslog shuts down. Must be “on” or “off”

Default
true

queue_size

Store no more than this number syslog messages in memory.

Default
100000

queue_timeout_enqueue

Discard messages if the queue + disk is full

Default
0

resume_interval

When action is suspended (dest not connected), retry after this number of seconds

Default
10

tls_enabled

Set this to true to enable TLS.

Default
false

transport

One of udp, tcp, relp.

Default
tcp

Templates

Templates are rendered and placed onto corresponding instances during the deployment process. This job's templates will be placed into /var/vcap/jobs/syslog_forwarder/ directory (learn more).

  • bin/pre-start (from pre-start.erb)
  • config/ca_cert.pem (from ca_cert.pem.erb)
  • config/rsyslog.conf (from rsyslog.conf.erb)

Packages

Packages are compiled and placed onto corresponding instances during the deployment process. Packages will be placed into /var/vcap/packages/ directory.

This job relies on no runtime packages.