3.4. Destinations and destination drivers

A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.

[Tip] Tip

If no drivers are defined for a destination, all messages sent to the destination are discarded. This is equivalent to omitting the destination from the log statement.

To define a destination, add a destination statement to the syslog-ng configuration file using the following syntax:

destination <identifier> { 
                destination-driver(params); destination-driver(params); ... };
            

[Example] Example 3.5. A simple destination statement

The following destination statement sends messages to the TCP port 1999 of the 10.1.2.3 host.

destination d_demo_tcp { tcp("10.1.2.3" port(1999)); };
            

If name resolution is configured, the hostname of the target server can be used as well.

destination d_tcp { tcp("target_host" port(1999); localport(999)); };
            

The following table lists the destination drivers available in syslog-ng.

Name Description
file() Writes messages to the specified file.
fifo(), pipe() Writes messages to the specified named pipe.
program() Forks and launches the specified program, and sends messages to its standard input.
sql()* Sends messages into an SQL database. *Available only in syslog-ng Premium Edition. In addition to the standard syslog-ng packages, the sql() destination requires database-specific packages to be installed. Refer to the section appropriate for your platform in Chapter 4, Installing syslog-ng.
tcp() Sends messages to the specified TCP port of a remote host.
tcp6() Sends messages to the specified TCP port of a remote host using IPv6.
udp() Sends messages to the specified UDP port of a remote host.
udp6() Sends messages to the specified UDP port of a remote host using IPv6.
unix-dgram() Sends messages to the specified unix socket in SOCK_DGRAM style (BSD).
unix-stream() Sends messages to the specified unix socket in SOCK_STREAM style (Linux).
usertty() Sends messages to the terminal of the specified user, if the user is logged in.

Table 3.4. Destination drivers available in syslog-ng


For detailed description of the supported drivers, see Section 9.2, “Destination drivers”.

[Note] Note

When using the file() destination, update the configuration of your log rotation program to rotate these files. Otherwise, the log files can become very large.


© 2007 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com