The syslog-ng 3.0 Administrator Guide

Procedure 5.2.1. Configuring the destination logservers

1. Start the configuration interface of the syslog-ng Agent for Windows application.

2. Select syslog-ng Agent Settings > Destinations > Network, and double-click on IPv4.

3. Select Add, and enter the hostname or the IP address of the logserver into the Server Name field. If your logserver is configured to accept messages on a non-standard port, type the port number into the Server Port field.

4. Select the protocol used to transfer log messages and press Reset to apply the selected template. The following protocol templates are available:

   • Legacy BSD Syslog Protocol: Use the legacy BSD-syslog protocol specified in RFC3164. This option uses the following message template: <${PRI}>${BSDDATE} ${HOST} ${APP_NAME}[${PROCESS_ID}]: ${MSG}.

   • Syslog: Uses the new IETF-syslog protocol specified in RFC 5424-5428 (see http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-23.txt and http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-11.txt. Starting from version 3.0, syslog-ng also supports the IETF-protocol.

   • Snare compatible BSD Syslog Protocol: Sends log messages in a format compatible with the Snare log monitoring tool, using the following template: <${PRI}>${BSDDATE} ${HOST} ${MSG}.

   	Note
   	Selecting the syslog protocol option is identical to using the syslog driver in syslog-ng 3.0. Similarly, selecting Legacy syslog is equivalent to the tcp driver of syslog-ng 3.0.

5. If you have a backup server that can accept log messages if the primary logserver becomes unavailable, select the Failover Servers tab, click Add, and enter the hostname or the IP address of the backup logserver into the Server Name field. Repeat this step if you have more than one backup servers.

6. If you want to send the log messages to more than on server in parallel, so that every server receives every message, repeat Steps 3-4 to add the secondary servers. Secondary servers may have failover servers as well.

   	Note
   	The syslog-ng Agent for Windows application considers a message received by the logserver if the primary server of the destination, or one of its failover servers receives it. To modify which server of a destination is the primary server, select syslog-ng Agent Settings > Destinations > Network > IPv4, select the server you want to be primary, and select Edit > Set Primary Server.

7. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service.