3.4. Destinations and destination drivers

A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.

[Tip] Tip

If no drivers are defined for a destination, all messages sent to the destination are discarded. This is equivalent to omitting the destination from the log statement.

To define a destination, add a destination statement to the syslog-ng configuration file using the following syntax:

destination <identifier> { 
                destination-driver(params); destination-driver(params); ... };

[Example] Example 3.16. A simple destination statement

The following destination statement sends messages to the TCP port 1999 of the 10.1.2.3 host.

destination d_demo_tcp { tcp("10.1.2.3" port(1999)); };

If name resolution is configured, the hostname of the target server can be used as well.

destination d_tcp { tcp("target_host" port(1999); localport(999)); };

The following table lists the destination drivers available in syslog-ng.

Name Description
file() Writes messages to the specified file.
logstore()* Writes messages to the specified binary logstore file. *Available only in syslog-ng Premium Edition.
fifo(), pipe() Writes messages to the specified named pipe.
program() Forks and launches the specified program, and sends messages to its standard input.
sql() Sends messages into an SQL database. In addition to the standard syslog-ng packages, the sql() destination requires database-specific packages to be installed. Refer to the section appropriate for your platform in Chapter 4, Installing syslog-ng.
syslog() Sends messages to the specified remote host using the IETF-syslog protocol. The IETF standard supports message transport using the UDP, TCP, and TLS networking protocols.
tcp() and tcp6() Sends messages to the specified TCP port of a remote host using the BSD-syslog protocol over IPv4 and IPv6, respectively.
udp() and udp6() Sends messages to the specified UDP port of a remote host using the BSD-syslog protocol over IPv4 and IPv6, respectively.
unix-dgram() Sends messages to the specified unix socket in SOCK_DGRAM style (BSD).
unix-stream() Sends messages to the specified unix socket in SOCK_STREAM style (Linux).
usertty() Sends messages to the terminal of the specified user, if the user is logged in.

Table 3.3. Destination drivers available in syslog-ng


For detailed list of driver parameters, see Section 8.2, “Destination drivers”.


© 2007-2010 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com