The syslog-ng 3.0 Administrator Guide

Source driver: A communication method used to receive log messages. For example, syslog-ng can receive messages from a remote host via TCP/IP, or read the messages of a local application from a file.

Source: A named collection of configured source drivers.

Destination driver: A communication method used to send log messages. For example, syslog-ng can send messages to a remote host via TCP/IP, or write the messages into a file or database.

Destination: A named collection of configured destination drivers.

Filter: An expression to select messages. For example, a simple filter can select the messages received from a specific host.

Macro: An identifier that refers to a part of the log message. For example, the $HOST macro returns the name of the host that sent the message. Macros are often used in templates and filenames.

Parser: A rule that segments messages into separate columns at a predefined separator character (e.g., a comma). Every column has a unique name that can be used as a macro.

Rewrite rule: A rule modifies a part of the message, for example, replaces a string, or sets a field to a specified value.

Log paths: A combination of sources, destinations, and other objects like filters, parsers, and rewrite rules. The syslog-ng application sends messages arriving to the sources of the log paths to the defined destinations, and performs filtering, parsing, and rewriting of the messages. Log paths are also called log statements. Log statements can include other (embedded) log statements to create complex log paths.

Template: A template is a set of macros that can be used to restructure log messages or automatically generate file names. For example, a template can add the hostname and the date to the beginning of every log message.

Option: Options set global parameters of syslog-ng, like the parameters of name resolution and timezone handling.