8.2.7. tcp(), tcp6(), udp(), and udp6()

This driver sends messages to another host on the local intranet or internet using the UDP or TCP protocol. The tcp6() and udp6() drivers use the IPv6 network protocol.

Both drivers have a single required argument specifying the destination host address, where messages should be sent, and several optional parameters. Note that this differs from source drivers, where local bind address is implied, and none of the parameters are required.

The udp() and udp6() drivers automatically send multicast packets if a multicast destination address is specified. The tcp() and tcp6() drivers do not support multicasting.

Declaration:
    tcp(host [options]);
    udp(host [options]);
    tcp6(host [options]);
    udp6(host [options]);

These destinations have the following options:

Name	Type	Default	Description
flags()	no_multi_line, syslog-protocol	empty set	Flags influence the behavior of the driver. The `no-multi-line` flag disables line-breaking in the messages; the entire message is converted to a single line. The `syslog-protocol` flag instructs the driver to format the messages according to the new IETF syslog protocol standard. If this flag is enabled, macros used for the message have effect only for the text of the message, the message header is formatted to the new standard. Note that this flag is not needed for the `syslog` driver.
flush_lines()	number	Use global setting.	Specifies how many lines are flushed to a destination at a time. Syslog-ng waits for this number of lines to accumulate and sends them off in a single batch. Setting this number high increases throughput as fully filled frames are sent to the network, but also increases message latency. The latency can be limited by the use of the `flush_timeout` option.
flush_timeout()	time in milliseconds	Use global setting.	Specifies the time syslog-ng waits for lines to accumulate in its output buffer. See the `flush_lines` option for more information.
frac_digits()	number	0	The syslog-ng application can store fractions of a second in the timestamps according to the ISO8601 format.. The `frac_digits()` parameter specifies the number of digits stored. The digits storing the fractions are padded by zeros if the original timestamp of the message specifies only seconds. Fractions can always be stored for the time the message was received. Note that syslog-ng can add the fractions to non-ISO8601 timestamps as well.
fsync()	yes or no	no	Forces an `fsync()` call on the destination fd after each write. Note: enabling this option may seriously degrade performance.
ip_tos()	number	0	Specifies the Type-of-Service value of outgoing packets.
ip_ttl()	number	0	Specifies the Time-To-Live value of outgoing packets.
keep-alive()	yes or no	yes	Specifies whether connections to destinations should be closed when syslog-ng is restarted (upon the receipt of a SIGHUP signal). Note that this applies to the client (destination) side of the syslog-ng connections, server-side (source) connections are always reopened after receiving a HUP signal unless the `keep-alive` option is enabled for the source. When the `keep-alive` option is enabled, syslog-ng saves the contents of the output queue of the destination when receiving a HUP signal, reducing the risk of losing messages.
localip()	string	0.0.0.0	The IP address to bind to before connecting to target.
localport()	number	0	The port number to bind to. Messages are sent from this port.
log_disk_fifo_size()	number	0	Size of the hard disk space in bytes that is used as disk buffer. Available only in syslog-ng Premium Edition when using the `tcp()`, `tcp6()`, `syslog()` (when using the `tcp` or `tls` transport methods), and `sql()` destinations. Can be also defined as a global option. See Section 2.14, “Using disk-based buffering” for details on using the disk buffer.
log_fifo_size()	number	Use global setting.	The number of entries in the output buffer (output fifo).
port() or destport()	number	514	The port number to connect to. Note that the default port numbers used by syslog-ng do not comply with the latest RFC which was published after the release of syslog-ng 3.0.2, therefore the default port numbers will change in the future releases.
so_broadcast()	yes or no	no	This option controls the `SO_BROADCAST` socket option required to make syslog-ng send messages to a broadcast address. See the socket(7) manual page for details.
so_keepalive()	yes or no	no	Enables keep-alive messages, keeping the socket open. This only effects TCP and UNIX-stream sockets. See the socket(7) manual page for details.
so_rcvbuf()	number	0	Specifies the size of the socket receive buffer in bytes. See the socket(7) manual page for details.
so_sndbuf()	number	0	Specifies the size of the socket send buffer in bytes. See the socket(7) manual page for details.
spoof_source()	yes or no	no	Enables source address spoofing. This means that the host running syslog-ng generates UDP packets with the source IP address matching the original sender of the message. It is useful when you want to perform some kind of preprocessing via syslog-ng then forward messages to your central log management solution with the source address of the original sender. This option only works for UDP destinations though the original message can be received by TCP as well. This option is only available if syslog-ng was compiled using the `--enable-spoof-source` configuration option.
suppress()	seconds	0 (disabled)	If several identical log messages would be sent to the destination without any other messages between the identical messages (for example, an application repeated an error message ten times), syslog-ng can suppress the repeated messages and send the message only once, followed by the `Last message repeated n times.` message. The parameter of this option specifies the number of seconds syslog-ng waits for identical messages.
template()	string	A format conforming to the default logfile format.	Specifies a template defining the logformat to be used in the destination. Macros are described in Section 8.5, “Macros”. Please note that for network destinations it might not be appropriate to change the template as it changes the on-wire format of the syslog protocol which might not be tolerated by stock syslog receivers (like `syslogd` or syslog-ng itself). For network destinations make sure the receiver can cope with the custom format defined.
template_escape()	yes or no	no	Turns on escaping `'` and `"` in templated output files. This is useful for generating SQL statements and quoting string contents so that parts of the log message are not interpreted as commands to the SQL server.
throttle()	number	0	Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using disk-buffer as well to avoid the risk of losing messages. Specifying `0` or a lower value sets the output limit to unlimited.
time_zone()	timezone in +/-HH:MM format	unspecified	Convert timestamps to the timezone specified by this option. If this option is not set then the original timezone information in the message is used.
tls()	tls options	n/a	This option sets various TLS specific options like key/certificate files and trusted CA locations. TLS can be used only with the `tcp` transport protocols. See Section 8.10, “TLS options” for more information.
ts_format()	rfc3164, bsd, rfc3339, iso	rfc3164	Override the global timestamp format (set in the global `ts_format()` parameter) for the specific destination. See also Section 7.7, “A note on timezones and timestamps”.

Table 8.14. Options for tcp, tcp6, udp, and udp6 destinations

Example 8.22. Using the tcp() driver

	Example 8.22. Using the tcp() driver
destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); }; If name resolution is configured, the hostname of the target server can be used as well. destination d_tcp { tcp("target_host" port(1999) localport(999)); }; To send messages using the IETF-syslog message format, enable the `syslog-protocol` flag: destination d_tcp { tcp("10.1.2.3" port(1999) flags(syslog-protocol) };

destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); };

If name resolution is configured, the hostname of the target server can be used as well.

destination d_tcp { tcp("target_host" port(1999) localport(999)); };

To send messages using the IETF-syslog message format, enable the syslog-protocol flag:

destination d_tcp { tcp("10.1.2.3" port(1999) flags(syslog-protocol) };

Example 8.23. Enabling disk-based buffering

	Example 8.23. Enabling disk-based buffering
The following example turns on disk-based buffering for the destination. The size of the disk buffer is 4 194 304 bytes (4 megabytes). In a worst-case situation, using the default value of the `log_msg_size()` parameter (8192 bytes), this disk buffer can store at least 512 messages. Typical log messages are about 300-500 bytes long, so a disk buffer of 4 megabytes can store over 8000 messages. Set the size of the disk buffer based on the average size and number of messages, and the longest estimated downtime of the server. destination d_tcp { tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };

The following example turns on disk-based buffering for the destination. The size of the disk buffer is 4 194 304 bytes (4 megabytes). In a worst-case situation, using the default value of the log_msg_size() parameter (8192 bytes), this disk buffer can store at least 512 messages. Typical log messages are about 300-500 bytes long, so a disk buffer of 4 megabytes can store over 8000 messages. Set the size of the disk buffer based on the average size and number of messages, and the longest estimated downtime of the server.

destination d_tcp { 
                    tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };

Prev	Up	Next
8.2.6. syslog()	Home \| Contents	8.2.8. unix-stream() & unix-dgram()

The syslog-ng 3.0 Administrator Guide

Document version: Thirteenth
Release date: September 23, 2010
Latest version available at the BalaBit Documentation Page