The syslog-ng 3.0 Administrator GuideDocument version: Thirteenth
|
 |
The syslog-ng 3.0 Administrator GuideDocument version: Thirteenth
|
|
This driver starts an external application or script and sends the log messages to
its standard input (stdin).
The program() driver has a single required parameter,
specifying a program name to start.
Declaration:
program(command_to_run);
The program() destination has the following options:
| Name | Type | Default | Description |
|---|---|---|---|
| flags() | no_multi_line, syslog-protocol | empty set |
Flags influence the behavior of the driver. The The |
| flush_lines() | number | Use global setting. | Specifies how many lines are flushed to a destination at a time.
Syslog-ng waits for this number of lines to accumulate and sends them off in
a single batch. Setting this number high increases throughput as fully
filled frames are sent to the network, but also increases message latency.
The latency can be limited by the use of the
flush_timeout option. |
| flush_timeout() | time in milliseconds | Use global setting. | Specifies the time syslog-ng waits for lines to accumulate in its output
buffer. See the flush_lines option for more
information. |
| frac_digits() | number | 0 | The syslog-ng application can store fractions of a second in the
timestamps according to the ISO8601 format.. The
frac_digits() parameter specifies the number of
digits stored. The digits storing the fractions are padded by zeros if the
original timestamp of the message specifies only seconds. Fractions can
always be stored for the time the message was received. Note that syslog-ng
can add the fractions to non-ISO8601 timestamps as well. |
| fsync() | yes or no | no | Forces an fsync() call on the destination fd after
each write. Note: enabling this option may seriously degrade
performance. |
| log_fifo_size() | number | Use global setting. | The number of entries in the output buffer (output fifo). |
| suppress() | seconds | 0 (disabled) | If several identical log messages would be sent to the destination
without any other messages between the identical messages (for example, an
application repeated an error message ten times), syslog-ng can suppress the
repeated messages and send the message only once, followed by the
Last message repeated n times. message. The
parameter of this option specifies the number of seconds syslog-ng waits for
identical messages. |
| template() | string | A format conforming to the default logfile format. | Specifies a template defining the logformat to be used in the
destination. Macros are described in Section 8.5, “Macros”.
Please note that for network destinations it might not be appropriate to
change the template as it changes the on-wire format of the syslog protocol
which might not be tolerated by stock syslog receivers (like
syslogd or syslog-ng itself). For network
destinations make sure the receiver can cope with the custom format defined.
|
| template_escape() | yes or no | no | Turns on escaping ' and "
in templated output files. This is useful for generating SQL statements and
quoting string contents so that parts of the log message are not interpreted
as commands to the SQL server. |
| throttle() | number | 0 | Sets the maximum number of messages sent to the destination per second.
Use this output-rate-limiting functionality only when using disk-buffer as
well to avoid the risk of losing messages. Specifying
0 or a lower value sets the output limit to
unlimited. |
| time_zone() | timezone in +/-HH:MM format | unspecified | Convert timestamps to the timezone specified by this option. If this option is not set then the original timezone information in the message is used. |
| ts_format() | rfc3164, bsd, rfc3339, iso | rfc3164 | Override the global timestamp format (set in the global
ts_format() parameter) for the specific
destination. See also Section 7.7, “A note on timezones and timestamps”. |
Table 8.11. Options for program()
© 2007-2010 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com
![[Example]](./example.png)