<p dir="ltr">The simplest way to create a plugin is to use the logthrdestination interface. There are examples of that in the existing modules.</p>
<p dir="ltr">The log proto interface plugs into the existing tcp/udp/network/syslog drivers, they are used when transport() option is specified.</p>
<div class="gmail_quot<blockquote class=" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thank you Tibor,<div><br></div><div>Right, I'm expecting a high volume of logs. Is there any example of syslog-ng module in C/C++/Go?</div><div><br></div><div>Thanks</div><div>Dmitry</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 15, 2016 at 12:11 AM, Tibor Benke <span dir="ltr"><<a href="mailto:ihrwein@gmail.com" target="_blank">ihrwein@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Dmitry<span style="font-size:12.8px;font-weight:bold;white-space:nowrap">,</span><div><br></div><div>The simplest way would be to use a Python destination. You can write your own one based on the documentation: <a href="https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/section_1.html" target="_blank">https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/section_1.html</a></div><div><br></div><div>I don't know the performance limits of it, I hope it's enough for you.</div><div><br></div><div>Best,</div><div>Tibor</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>2016-06-15 8:47 GMT+02:00 Dmitry Shmulevich <span dir="ltr"><<a href="mailto:dima8080@gmail.com" target="_blank">dima8080@gmail.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><p dir="ltr">Hello,</p>
<p dir="ltr">I'm looking for an advice.</p>
<p dir="ltr">I'm sending the logs from my machine to a third-party server. The protocol between the client (syslog-ng service) and the third-party server is quite simple: for each received log entry the server replies with a confirmation message on the same tcp socket.<br>
Currently I'm using a simple syslog-ng config to send logs via network driver to a specified ip/port. However, since syslog-ng service doesn't receive/read the messages from the server, the connection eventually dies.</p>
<p dir="ltr">Is there any way to modify syslog-ng config to allow reads after writes? I didn't find anything similar in the documentation.</p>
<p dir="ltr">An alternative way seems to be implementing a syslog-ng module or a plugin. Would that be the right approach?<br>
It seems that I can customize _LogProtoClient structure, and create a plugin. But I have no clue on how the overall API looks like, and what are the steps to build the module.</p>
<p dir="ltr">Could you guys point me to the right resources? <br>
Is there any sample plugin, or a guidance for developing custom plugins?</p>
<p dir="ltr">Thank you in advance,<br>
Dmitry</p>
<br></div></div>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></div>